Behavioral task
behavioral1
Sample
1448-56-0x0000000000400000-0x000000000041D000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1448-56-0x0000000000400000-0x000000000041D000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1448-56-0x0000000000400000-0x000000000041D000-memory.dmp
-
Size
116KB
-
MD5
67c27adb21c4ae9e0f8f6f04d465080e
-
SHA1
dbc25dadb58efac17a1c65d93d6b0f9301fadceb
-
SHA256
cab4edf5b37395003f0b9aa729d43371cb437b04761d047a98e03a1d30746376
-
SHA512
cbe24ce0fa09afac2aa65b5196ab78b73a67569864d2092e104ac464b3fba489a4d343367ac8b48802da3f10cea93a71d38d69fece72b60f6c280f24e6e83b30
-
SSDEEP
1536:Bpaiq0I2XvL/5kVvpyITHAOEH8pIZ+msXvsfJre8oJ1C7uj9m:BpaikE/5SppIZ+m2sfJrebJF
Malware Config
Extracted
raccoon
bbbd8c4f062887157c5c54f47994f907
http://103.155.93.161/
Signatures
-
Raccoon family
Files
-
1448-56-0x0000000000400000-0x000000000041D000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 95KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE