Behavioral task
behavioral1
Sample
1780-62-0x0000000000400000-0x0000000000411000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1780-62-0x0000000000400000-0x0000000000411000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1780-62-0x0000000000400000-0x0000000000411000-memory.dmp
-
Size
68KB
-
MD5
9d24975f308d220f8d41cf7b995f33ab
-
SHA1
52249e08f86d88be9052474b17d2e54b4edeae2b
-
SHA256
28559d7ae1e9ffe6e268b053ec860bc180935f3d0bf0b24cab33af270c40f3c3
-
SHA512
be1780c1d384eddce64923b5a42dbecc91d5bd10cfb3097a1a021cf6c69330dcfea9009a2b2b06fa261bdcf71d52845aa090391882c5d62f835d835b071c5b9b
-
SSDEEP
768:I+6wtoXuUHKxI2zN5JjR2yAKJwA2eLVv3z5nNYJNKEz1qxsuSex/y9yoOBMM:I2toeUqu2/5AKJwA3vnNYJNpzVAFg
Malware Config
Extracted
raccoon
12ab26c1b0d2b25d17762b862d7e3e2b
http://45.8.144.152/
http://45.8.144.153/
http://45.8.144.151/
Signatures
-
Raccoon Stealer payload 1 IoCs
resource yara_rule sample family_raccoon -
Raccoon family
Files
-
1780-62-0x0000000000400000-0x0000000000411000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ