Behavioral task
behavioral1
Sample
4320-133-0x0000000000400000-0x0000000000DAF000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4320-133-0x0000000000400000-0x0000000000DAF000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4320-133-0x0000000000400000-0x0000000000DAF000-memory.dmp
-
Size
9.7MB
-
MD5
4d85dac624b125ee0e03cac96c66f1ae
-
SHA1
bb96913fa7e206c74fe161ca7a217f2a03078c03
-
SHA256
9f917740f7f2e3af46c78c7e8d6326db81a1074182d09ad56db9da9f6cfff9f1
-
SHA512
a8b9842a08df62ad0cae803f41e90f57b9855eda7bfe83d39819a76218ee37ed98ec7cf1a14907e87443e87b92ee8a80ab6171d47601d15ccec5a65af3b6e862
-
SSDEEP
196608:U6RYfMd7XCDGsQF9RlAmD/cRu3LyA8OYtgd/bS/4jqJK7nmLAqq:U6RYwXMPQjRCmq5KjS/ojnB
Malware Config
Extracted
raccoon
4ee4e2ee5aa36d394f5d44408a602375
http://168.119.60.182/
Signatures
-
Raccoon family
Files
-
4320-133-0x0000000000400000-0x0000000000DAF000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.9}5 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.d;M Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.,-i Size: 5.9MB - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 398KB - Virtual size: 398KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ