Behavioral task
behavioral1
Sample
1376-89-0x0000000000CE0000-0x000000000148F000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1376-89-0x0000000000CE0000-0x000000000148F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1376-89-0x0000000000CE0000-0x000000000148F000-memory.dmp
-
Size
7.7MB
-
MD5
3e18328de325509f7b00350c64262e1f
-
SHA1
6286e3ffca9e02fa017effe8116deb6f50ba56c8
-
SHA256
5be6578cd48f193ec18fa3e9776e4168eb5303093f0fc30f68f3aad68096b11c
-
SHA512
46c9de55f8c758d7a9c0164ced556fc4c93c9a618364517679b875abbc973c46ded60270909630cbeaba7c6543e37cca997df7379123fd4129be443f30781e1d
-
SSDEEP
98304:a5oRQX9j687yc6Dr95CQgJrQXnwElVaIWx4sCvu3S7e:aiDr/zX1KVx4s2u3p
Malware Config
Signatures
-
Raccoon family
Files
-
1376-89-0x0000000000CE0000-0x000000000148F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 2.5MB - Virtual size: 7.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE