Behavioral task
behavioral1
Sample
4824-132-0x0000000000400000-0x0000000000EB6000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4824-132-0x0000000000400000-0x0000000000EB6000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
4824-132-0x0000000000400000-0x0000000000EB6000-memory.dmp
-
Size
10.7MB
-
MD5
016cbeffe53119d7d33ec8092d7eb70f
-
SHA1
a94f042dc170dc80fb4aec5004cb306e3b9d0833
-
SHA256
c0a0902266129aaea24faf58e620681db6667b512ce5da7ae4db0dd7ab55c16c
-
SHA512
4f24e76748f6f79ec4335c9ca935af6b22b3bac547ee0b0a496f5fd29621065dbf7ff5026bd1dc4b74899ce6d81e7c831b53af9c9be9d849dec6ac1bb1835b57
-
SSDEEP
196608:uXDYLuRf1pTalAUsF2APYMVna7GK6i54hqjqmA6dn4XA9YO8d:uXOlwbQMpaQw0qjqT66Q9YO
Malware Config
Extracted
raccoon
0eceb3d1f21f3ea1b454c7f4a9867731
http://146.70.86.11/
http://69.46.15.158/
Signatures
-
Raccoon family
Files
-
4824-132-0x0000000000400000-0x0000000000EB6000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.V;[ Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.[@K Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.u\E Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 325KB - Virtual size: 324KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ