Behavioral task
behavioral1
Sample
2124-169-0x0000000000400000-0x00000000007EE000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2124-169-0x0000000000400000-0x00000000007EE000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
2124-169-0x0000000000400000-0x00000000007EE000-memory.dmp
-
Size
3.9MB
-
MD5
4847bc044de7d20481a970e9d8003928
-
SHA1
8683fe2bddf6ac19650bd08f6e435a668b21ebfb
-
SHA256
d73fb55143799bf6f4e17d1f4a92c7b57b82e721b0b26836fe3039f2d6013096
-
SHA512
94413b17b3b952a282771cd0e8861a3e08f00953ee8c4a3d4f8204f8b28a3f2f9aaa9feac8d1b7f7a7dd8b8239813e4873f6bfff0acadd641a75a9e3133fa2c4
-
SSDEEP
6144:v1nD1mR0t/6eQm+Q2EScZAtZeD1NTph7bnxHE6f4:tnDsR8/RQm+QPScZh1797FE6
Malware Config
Extracted
raccoon
567d5bff28c2a18132d2f88511f07435
http://116.203.167.5/
http://195.201.248.58/
Signatures
-
Raccoon family
Files
-
2124-169-0x0000000000400000-0x00000000007EE000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ