Behavioral task
behavioral1
Sample
1192-57-0x0000000000400000-0x0000000002C39000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1192-57-0x0000000000400000-0x0000000002C39000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1192-57-0x0000000000400000-0x0000000002C39000-memory.dmp
-
Size
40.2MB
-
MD5
ec37effe5d678e264191f18d66d3a3b3
-
SHA1
b923ff18658a5fe1fd583b6c50c5d6baffd1e816
-
SHA256
3ab38a0c7d24b76708e80da62056cead804acf3cad26bdffe1b260835e6d1815
-
SHA512
052b77fa6629b3dcb4759ebfbd941f0ccd59d2d059fbaf2864f2204a22fae731d73cbcb721597bd60cd31ede40af882a9d45b6f860cebef8011bffc656427b36
-
SSDEEP
3072:j1EcfBUDZi0bK8P55GI4Do9tzxHm8y9C9dkndrTbPNMVQDa64zUT:FmWW3dxG8y9XNH2aa6b
Malware Config
Extracted
raccoon
dde3f69d00a438843e8c5509eb29534e
http://95.141.41.13/
Signatures
-
Raccoon family
Files
-
1192-57-0x0000000000400000-0x0000000002C39000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ