Behavioral task
behavioral1
Sample
4768-173-0x0000000000400000-0x00000000007EE000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4768-173-0x0000000000400000-0x00000000007EE000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4768-173-0x0000000000400000-0x00000000007EE000-memory.dmp
-
Size
3.9MB
-
MD5
13c88e382abe0ceef80ed74715f5ac83
-
SHA1
e4b729b93fbc1ebe7e3ebbe4d43368036b73a012
-
SHA256
459098bc78f73ab75de8a3674692d8e28782bc4530564e9625677070c9eb0a0b
-
SHA512
47a51d324ba2561a427ab0511e518de55720b2549326cd7c25dada6db47a9ce40a2e3c43c4b365a532e1391f21e5e513f291085c726a3ccc16750b72c4b742e8
-
SSDEEP
6144:v1nP1FR0t/6eQm+Q2EScZAtZeD1NTph7bnxHE6f4:tnPjR8/RQm+QPScZh1797FE6
Malware Config
Extracted
raccoon
567d5bff28c2a18132d2f88511f07435
http://116.203.167.5/
http://195.201.248.58/
Signatures
-
Raccoon family
Files
-
4768-173-0x0000000000400000-0x00000000007EE000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ