Behavioral task
behavioral1
Sample
3048-191-0x0000000050590000-0x000000005060D000-memory.exe
Resource
win7-20220718-en
General
-
Target
3048-191-0x0000000050590000-0x000000005060D000-memory.dmp
-
Size
500KB
-
MD5
ce07fab696530dc3fdc7adb769347a66
-
SHA1
57f997c2145952e3e75724c81986a99d5b7b950a
-
SHA256
9ff04007def7d23398205b5095fba7ff1d0effb5deac06052dd2f0e7bf410beb
-
SHA512
e8a154ace8e5ba7c241d7991e1d0e4171dc54b22c3fced4acf9a69775806ffaaafe3001622929ef7c06d39be428be68e6cdfeca916f98f0d124beab0132e11aa
-
SSDEEP
6144:eOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcU8yg:eOFtiNBuFgawDB4NOmuwsfZPPyg
Malware Config
Signatures
-
Remcos family
Files
-
3048-191-0x0000000050590000-0x000000005060D000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 467KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE