Behavioral task
behavioral1
Sample
392-150-0x0000000000400000-0x0000000000E43000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
392-150-0x0000000000400000-0x0000000000E43000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
392-150-0x0000000000400000-0x0000000000E43000-memory.dmp
-
Size
10.3MB
-
MD5
8e5a278458f218545fe8a9c847b54983
-
SHA1
332ec21156791d671569dc691a4237cb4fd01f87
-
SHA256
2315674606fab115f50425c3ace481f4b4241de9492616866ea3968dce05b9ca
-
SHA512
b9cd2babfa267e65be0c391f526257b8b09d4f854ffa130d790cad92289860df0ca89faa1e063f70c88149240cf450ec5aca6e263938376df023b57cb4fdf5f7
-
SSDEEP
98304:fPD3u3ZBMiCxWqfG3a4ItNrR/GQBM3M68t9dyfez1NP8+uuN7PYotBe4oqPjKWOa:zcZt2gIddmR8ndya1NU+d7FLFVnKen2
Malware Config
Extracted
raccoon
7394a7fc5da9794209d8b0503ca4abf4
http://45.8.145.203
Signatures
-
Raccoon family
Files
-
392-150-0x0000000000400000-0x0000000000E43000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.P&w Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.R_B Size: 1024B - Virtual size: 864B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.'/$ Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 427KB - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ