Behavioral task
behavioral1
Sample
2516-0-0x0000000000100000-0x00000000005FE000-memory.exe
Resource
win7-20240903-en
General
-
Target
2516-0-0x0000000000100000-0x00000000005FE000-memory.dmp
-
Size
5.0MB
-
MD5
26bdee3bd69d6012c31df7a43c2b6d8b
-
SHA1
a1fced4ca7aafeac3b5ddfd4df174e4fa12f2dcd
-
SHA256
cb2ef919f93eb9f4ac4126df67c6e2f9cf6802545efee300cd1ea43a8b16a1c2
-
SHA512
d596fc0cb62fecb14dcafbf3b71f70e400848a83c7d95efa29f66750df6cad81b539ad962fcadb76c6a34bef7257551968612ef74486d2e74909dfc5cfc31a5d
-
SSDEEP
49152:RDSfv1hZ3bCD872uazzKdePOIfzn92Cihh1T1:E1hZL52dyIfznbqvJ
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2516-0-0x0000000000100000-0x00000000005FE000-memory.dmp
Files
-
2516-0-0x0000000000100000-0x00000000005FE000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gngdpjhn Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
poaqzqjh Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE