Behavioral task
behavioral1
Sample
2084-0-0x0000000000810000-0x0000000000CF7000-memory.exe
Resource
win7-20240903-en
General
-
Target
2084-0-0x0000000000810000-0x0000000000CF7000-memory.dmp
-
Size
4.9MB
-
MD5
d42425152d3e62f9c85a527fe6ac015e
-
SHA1
757b445c90811ead7d68db757095ca8952c30f2e
-
SHA256
659105f9979080268a507838e1d430a5bdef56cb3396c3664a1054a9e10e1315
-
SHA512
426bdf35cc283727dc37be15074ddb675eae7e94463e2f635eb9c649095eaa8eb1fad0c491015c720b4b014ca9d580e0b53f3a82a6834813e0281ca333ba8d87
-
SSDEEP
24576:JcTklsKtO7PM7GC9YJM44hLqWknqYkMN46emXhR0GZcDwnV7JCqr8gq25GrL7O9N:J9FtN7YQhLqSPM7xv7b1urE5zn5
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2084-0-0x0000000000810000-0x0000000000CF7000-memory.dmp
Files
-
2084-0-0x0000000000810000-0x0000000000CF7000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wwoisyok Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
sskyvrkh Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE