Behavioral task
behavioral1
Sample
4956-132-0x0000000000400000-0x0000000000E83000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4956-132-0x0000000000400000-0x0000000000E83000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
4956-132-0x0000000000400000-0x0000000000E83000-memory.dmp
-
Size
10.5MB
-
MD5
ec9b71bd277517a59d2f3abf7f11f5c0
-
SHA1
85a3ca313894828b285d39017e0e047a6be5df85
-
SHA256
bc2cc90a481254bc7cd12b30a2e8fa8611a358db12415b2b42977e78fd5557b1
-
SHA512
dd935073557f7a0d9638a1e6846a0d4b86159d06cba585b7948334f1192f66ff6fbc1a8de13ed33fcfeaed7e0e9df74e4d2427224c8bae7e7c523d35cc27238f
-
SSDEEP
196608:CfIM3dlf1qk+lRtPcO1O2toj+OLaJJiSb4tlUVHQf6bSU5EuklXBAuFiti:CQILpwcOgj+OOJMXUVHQg7kj
Malware Config
Extracted
raccoon
4e27b39e9aaa6403f36702b4d66f5024
http://94.142.138.10/
http://94.142.138.9/
Signatures
-
Raccoon family
Files
-
4956-132-0x0000000000400000-0x0000000000E83000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VG" Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.|u9 Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.=uO Size: 6.5MB - Virtual size: 6.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ