Behavioral task
behavioral1
Sample
4968-140-0x0000000000400000-0x0000000000E41000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4968-140-0x0000000000400000-0x0000000000E41000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
4968-140-0x0000000000400000-0x0000000000E41000-memory.dmp
-
Size
10.3MB
-
MD5
57cf7ca16f2974bd938e6be14519dc0e
-
SHA1
9efbadc0236273d48dbd8952735a7b561751bfbe
-
SHA256
a461b66d457c37c92ad508620c384e51fe5db134ceee93ec4343b4be62920f9c
-
SHA512
2147289a5c4cf05c4b6873c10963870935220c67557f5316465f16ec943a3a220ed0037c5f2adb8354c9152fe92c85948811f4fee3033a43678e58c390471df4
-
SSDEEP
196608:CdM6xjDKF3UOKkHgdjGyHkpUI+/B0d1FOw1vGzZQ7Ey3aHczOBfmpLHe+V:C/FKtqdBRI7bowozaQy3NzOcHe
Malware Config
Extracted
raccoon
f1c3f7a3e12da19758239f0284e7dc2c
http://83.217.11.34
http://83.217.11.35
Signatures
-
Raccoon family
Files
-
4968-140-0x0000000000400000-0x0000000000E41000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sx% Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.qd- Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VAZ Size: 6.2MB - Virtual size: 6.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 306KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ