Behavioral task
behavioral1
Sample
2012-135-0x0000000000400000-0x0000000001A95000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2012-135-0x0000000000400000-0x0000000001A95000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2012-135-0x0000000000400000-0x0000000001A95000-memory.dmp
-
Size
22.6MB
-
MD5
da9f66385cf1ff64074ee797c7c615a2
-
SHA1
b1cd8c97ebc2857dbe8b562044c2fdcccff87d66
-
SHA256
4970aa134e495378da23bae3eab24dcc66c40e5919174a044432dd2dc74f85e7
-
SHA512
b6e4ff0bb40fba3f536bb776afdfb1fd0565052b376e8fb0c4d550ffa71ea3bda5335d3807af1d6fb05d4a69b7c30cf4306ddda5ada64049ffaae715845af463
-
SSDEEP
393216:XUmgafUsPyPN8WD8344qX520KzlIOxqMMB8PnXDU3T6XCkR0XCbivMN:kmgaM18zO8RJIkqlBQu6XCkRhb
Malware Config
Extracted
raccoon
540b1db0b12b23e63e6942952aa03e47
http://37.220.87.66/
http://77.73.134.0/
Signatures
-
Raccoon family
Files
-
2012-135-0x0000000000400000-0x0000000001A95000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.}*e Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Q?I Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
..{0 Size: 12.3MB - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 456KB - Virtual size: 498KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ