Behavioral task
behavioral1
Sample
5100-135-0x0000000000400000-0x0000000001A95000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
5100-135-0x0000000000400000-0x0000000001A95000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
5100-135-0x0000000000400000-0x0000000001A95000-memory.dmp
-
Size
22.6MB
-
MD5
223584e42ba7dd08b3a7750d0cb4ec65
-
SHA1
fab86bd6d4f857adefd63434b29d86c1934bca4e
-
SHA256
e975357efdc76bdcc1f0186a020dfbbb0f84d820d2b94717fc89ef30c0800e4f
-
SHA512
37557992d3989c0b31edd7f6e40fecbfe4d3675f1f1de7eca012b6ee2e1ec23d0f1a7aec6cb6fe62e224eec844b0dffc7feaafe256b63722b003f8b0a38eb431
-
SSDEEP
393216:8L2gyXMM6ynNkWecnTgDX520KzlIOxqMMB8PnXDU3T6XCkR0XCbivMN:c2gytNkoa8RJIkqlBQu6XCkRhb
Malware Config
Extracted
raccoon
540b1db0b12b23e63e6942952aa03e47
http://37.220.87.66/
http://77.73.134.0/
Signatures
-
Raccoon family
Files
-
5100-135-0x0000000000400000-0x0000000001A95000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.}*e Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Q?I Size: 1024B - Virtual size: 916B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
..{0 Size: 12.3MB - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 456KB - Virtual size: 498KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ