Behavioral task
behavioral1
Sample
4828-408-0x0000000000400000-0x0000000002B7F000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4828-408-0x0000000000400000-0x0000000002B7F000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4828-408-0x0000000000400000-0x0000000002B7F000-memory.dmp
-
Size
39.5MB
-
MD5
e79488d353a7aa9acca609dd7ba39600
-
SHA1
8a51828a557150b53d673ad7f1385603ef9bdb9a
-
SHA256
5928cbb56764d6e0017f5b1b5cb29c59813e42a153b03152238ddaaf27a88237
-
SHA512
70d9ad64ae9b1a3327e872a73832cb99338dce755fe35176b5801db51f20d344a334cc5414872d1d88da8b622f5112345e6afcfa2c4e40b994382731f8b380cc
-
SSDEEP
3072:v1EMGexnG0Y18k54XZ7FsKkn1Eq7x3I4wf7SRE8ifqvgx:v1nk1g1F/knCImX+RE8qq
Malware Config
Extracted
raccoon
567d5bff28c2a18132d2f88511f07435
http://116.203.167.5/
http://195.201.248.58/
Signatures
-
Raccoon family
Files
-
4828-408-0x0000000000400000-0x0000000002B7F000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ