Behavioral task
behavioral1
Sample
1120-61-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1120-61-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1120-61-0x0000000000400000-0x000000000041E000-memory.dmp
-
Size
120KB
-
MD5
a55ebd6fa9e578fa36a9f29e36300c17
-
SHA1
03aaa895abf53d348fdce78369a5a8ef2e0b9e80
-
SHA256
1a0d322293a688adc93885e1c588694598f66c66ee68caf7abd6b0efeba5fcab
-
SHA512
72d0faeceef4d7dad8e5ceb6d692bed7709779faed3c32a4be3b6e9aed6f2e3dd1cc9a071073d53c64353b15530777f13ee2acfe808b9719a5a42a6dd052d47b
-
SSDEEP
1536:d0jcjzCB6WeKjhKY/hINnAsmLps3K6iAGuSayJCPieRMRGpq5:QcjzCB6WfhK4IULps3K6RbSlCPiSE75
Malware Config
Extracted
raccoon
3f4a8564e5026a245d6974b020b3f6de
http://45.15.156.225/
Signatures
-
Raccoon family
Files
-
1120-61-0x0000000000400000-0x000000000041E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ