Behavioral task
behavioral1
Sample
1060-0-0x0000000000460000-0x0000000000AFD000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1060-0-0x0000000000460000-0x0000000000AFD000-memory.exe
Resource
win10v2004-20250129-en
General
-
Target
1060-0-0x0000000000460000-0x0000000000AFD000-memory.dmp
-
Size
6.6MB
-
MD5
9d5ca6a7b18de7ecb7bcf0aef181b45b
-
SHA1
0996b5058f762e9fc0993ef23251a5fe0e8cef3f
-
SHA256
f19f543cde3be3bdb9138fd957e0f26fd7671217f668073058d3a4e3d04dbe7f
-
SHA512
60282d8dae92bfe2ac3e036698962747ca53be33a87e3e5383d9c93a8958d2b28dda1b99ab2e2e9f1626abbbe28d1e1447aa680cc6ea82a0663f0a97010364d5
-
SSDEEP
3072:M5jfJ/SDJxm7Q9r3MyBPIy+78y3PgJkIkUG1I3/8r:q+13MyNmgy3PCkdUGK3/E
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1060-0-0x0000000000460000-0x0000000000AFD000-memory.dmp
Files
-
1060-0-0x0000000000460000-0x0000000000AFD000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kudwziic Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yhawepmy Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE