Behavioral task
behavioral1
Sample
1364-57-0x0000000000400000-0x0000000000588000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1364-57-0x0000000000400000-0x0000000000588000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1364-57-0x0000000000400000-0x0000000000588000-memory.dmp
-
Size
1.5MB
-
MD5
d5d6eb6ce3c092f32f443e99837024cb
-
SHA1
8ba3e9a56073180f81b50b1f86c3dcfaf6255ef8
-
SHA256
dd593ba6a1100063845e07ff6902a9c94d1a0cea09bafffb4acc20331d3f6bef
-
SHA512
3a569e2d1983db4ac4255b0396fbfccddc7c4be9a28dcffc084aeaa42698fcae2a33392324b8b79f00064b7c47d02d29cd10065cb554d52a811b52c67c45faed
-
SSDEEP
3072:j1EcfBUDZi0NKYvGT1fx5H2YMg6uDkv8PZana6N5fcllKXzwlyJ:FmI2GT172e5PZaa67ucjwI
Malware Config
Extracted
raccoon
dde3f69d00a438843e8c5509eb29534e
http://95.141.41.13/
Signatures
-
Raccoon family
Files
-
1364-57-0x0000000000400000-0x0000000000588000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ