Behavioral task
behavioral1
Sample
2032-57-0x0000000000400000-0x0000000001516000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
2032-57-0x0000000000400000-0x0000000001516000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
2032-57-0x0000000000400000-0x0000000001516000-memory.dmp
-
Size
17.1MB
-
MD5
b85bc506d9c30769b62ef0acda01e45d
-
SHA1
4f22e66a7cf051534a5fb59ab359315916e0b84c
-
SHA256
ea25cb29d79b7e03296d145b54800c15702c01a415a29f08136c8f31e583ade7
-
SHA512
838311ea25c4a5f005397313153f0d517bf76fd4706aaec345df4b2531636339ecce3a90976dbfc197caec2798612a4f0b9f7501953416b9e4d51974fae27ae9
-
SSDEEP
393216:a5Il9MpPdS03kKTJ0B+hZRHuxYXI51m+bXSjYJbPb0C:2P3kJcH/A1mcX1PAC
Malware Config
Extracted
raccoon
b976426d932f4197e7f31543c89444ff
http://51.81.160.184/
Signatures
-
Raccoon family
Files
-
2032-57-0x0000000000400000-0x0000000001516000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.NZ. Size: - Virtual size: 7.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.jrO Size: 1024B - Virtual size: 884B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!-S Size: 9.6MB - Virtual size: 9.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 428KB - Virtual size: 427KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ