Behavioral task
behavioral1
Sample
3484-148-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3484-148-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3484-148-0x0000000000400000-0x000000000041E000-memory.dmp
-
Size
120KB
-
MD5
53fb672de92954b09171926bcbcd0106
-
SHA1
7abd18454f70d0f058d6536593be7fc061fa165c
-
SHA256
e2ae726881e75872f16294932c4c837b21bec2b8460c6bf10c246a4c913bfc99
-
SHA512
642cd00008ffe9df285e974a02cd639a6712acb259968cec0d23ca9d6deca2d4bac46a9f75e3dfd6aa61570f4fced5965332d7f65724421f157a9438ee1bff9b
-
SSDEEP
1536:d0jcjzCB6WeKjhKY/hINnAsmLps3K6iAGuSayJCPieRMRGpq5:QcjzCB6WfhK4IULps3K6RbSlCPiSE75
Malware Config
Extracted
raccoon
3f4a8564e5026a245d6974b020b3f6de
http://45.15.156.225/
Signatures
-
Raccoon family
Files
-
3484-148-0x0000000000400000-0x000000000041E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ