Behavioral task
behavioral1
Sample
3888-141-0x0000000000400000-0x0000000000414000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3888-141-0x0000000000400000-0x0000000000414000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3888-141-0x0000000000400000-0x0000000000414000-memory.dmp
-
Size
80KB
-
MD5
ae4b2560350a1bce266a28e1d8a1f5bf
-
SHA1
e35140416e4a1e6a83bca277fe23231e76282e0d
-
SHA256
243da0e1a98cd4a770a9e6b96b8d49f3bcd98666b942cf477943005dd3e0f79f
-
SHA512
84afa78d6e8d89a08402da21379ad42564d57b987d6e59fd789387379165f4632296924aac0803a2ae9bccd9d7d0a2b1568b76f8b5472017bec97f0ac1f32989
-
SSDEEP
768:G3hBdh98zo8hUzAMgRt5O9hDtqCD+4yNdQiEw6ZjqZeS6RxUhS:AdMzAzjavO9uG+NNdQ4MGQR+
Malware Config
Extracted
raccoon
50ce52939fb6e92321d54656d9ae3d11
http://31.41.244.88
Signatures
-
Raccoon family
Files
-
3888-141-0x0000000000400000-0x0000000000414000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ