Behavioral task
behavioral1
Sample
1096-132-0x0000000000400000-0x0000000000DAF000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1096-132-0x0000000000400000-0x0000000000DAF000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1096-132-0x0000000000400000-0x0000000000DAF000-memory.dmp
-
Size
9.7MB
-
MD5
a897a73b6b9ff929373a27da7932ff35
-
SHA1
430053f6350029e04ec6a3bf1d346bc3f04f3d04
-
SHA256
aaf55882633e30a91aabf270ab8515d761812461c2d3ce61f87b2757d0237889
-
SHA512
b1770cafe7ba8c7e8356b05c3334259e346c1dae879801dc521480ef0439cba302b8e811426862b45c92a6376ca77e2adfdc2771400e1631b1737669440a1042
-
SSDEEP
196608:SGFs/MMudyFx/ewLn5CmD/cRu3LyA8OYtgd/bS/4jqJK7nmLAqq:SGFsCdeheqn4mq5KjS/ojnB
Malware Config
Extracted
raccoon
4ee4e2ee5aa36d394f5d44408a602375
http://168.119.60.182/
Signatures
-
Raccoon family
Files
-
1096-132-0x0000000000400000-0x0000000000DAF000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.9}5 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.d;M Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.,-i Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 398KB - Virtual size: 398KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ