Behavioral task
behavioral1
Sample
3916-147-0x0000000000400000-0x00000000007ED000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3916-147-0x0000000000400000-0x00000000007ED000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3916-147-0x0000000000400000-0x00000000007ED000-memory.dmp
-
Size
3.9MB
-
MD5
7efc7b2ef22c6773124acd75340ba6e5
-
SHA1
fdbc8fd8e8e86864919eabf8bb908d237e5fe416
-
SHA256
494c3074fd7b26060049edae2ae844ef41aa0511e2fec5c0a6644f72a39c6854
-
SHA512
4481d4e642a44a4b3139343c0fe5a73a3563511ba3aeea07d50c8b8eb591c1bd4d05b44307d43b0a5c63c12e14074687ade941e77eadf96cb15f93628aefce98
-
SSDEEP
6144:v1n11b6j6zj2a5WOBQOQygkkjVdWDak/:tn1B6jgj2a5ZBQLkkkd
Malware Config
Extracted
raccoon
567d5bff28c2a18132d2f88511f07435
http://116.203.167.5/
http://195.201.248.58/
Signatures
-
Raccoon family
Files
-
3916-147-0x0000000000400000-0x00000000007ED000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ