Behavioral task
behavioral1
Sample
2532-12-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2532-12-0x0000000000400000-0x0000000000426000-memory.exe
Resource
win10v2004-20240611-en
General
-
Target
2532-12-0x0000000000400000-0x0000000000426000-memory.dmp
-
Size
152KB
-
MD5
62d32138223316aedbc115e97b8dd597
-
SHA1
089a332845abebf913caa10114b03ed2226a5ce8
-
SHA256
752d922d468856de189856d89d3df8c6237ab56ac52a0c301bea1d8227f6205d
-
SHA512
6c5554db2c96a0bdb4b1760bdf4bc923d41c4054de701cfe3dcf9a1188a7712f2516e38229ae1f438005d51d20ea1e4442df6d4570dc61bd008034664d01ed9d
-
SSDEEP
3072:zVJg2V2QyG3YZvp3UFbcrwxt5RMVbqwE5K1Kbv4XysDor2vrsHMKpHbaPimW8wvL:I2V2QyG3YZvpUFbcrwxt5RMVbqwE5K1F
Malware Config
Extracted
snakekeylogger
https://api.telegram.org/bot7301432976:AAH31iVg7cEj_CK4xnKcLgyVuIYziQoJStE/sendMessage?chat_id=1182519128
Signatures
-
Snake Keylogger payload 1 IoCs
Processes:
resource yara_rule sample family_snakekeylogger -
Snakekeylogger family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2532-12-0x0000000000400000-0x0000000000426000-memory.dmp
Files
-
2532-12-0x0000000000400000-0x0000000000426000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ