Behavioral task
behavioral1
Sample
2712-0-0x0000000001160000-0x0000000001809000-memory.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2712-0-0x0000000001160000-0x0000000001809000-memory.exe
Resource
win10v2004-20250207-en
General
-
Target
2712-0-0x0000000001160000-0x0000000001809000-memory.dmp
-
Size
6.7MB
-
MD5
d56b471d0bd7ecd78de0378a0e51f1ca
-
SHA1
8bebc576672b9b9aced408eed3890be2629b2993
-
SHA256
f6c59d0687f054a962656db321a4b342799e0bb26720c4fbba958bb49ea6113e
-
SHA512
59dc062a6a54d72c2fbe27773cfa86392a1e59ccd99297e050e2f1aa25beea915475259492192c1651b01c432e1a7413cc8f61501e54ab223bf3ae7b494ca6f9
-
SSDEEP
3072:EOmOzS2b6EJOR/CpPf4DSNDEgm053lpQLHIWyyghbEaoe:xJO9DSN4UVeHwZwW
Malware Config
Signatures
-
Stealc family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2712-0-0x0000000001160000-0x0000000001809000-memory.dmp
Files
-
2712-0-0x0000000001160000-0x0000000001809000-memory.dmp.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 90KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 908B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
aoigaokn Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
whclvprm Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE