Behavioral task
behavioral1
Sample
3816-141-0x0000000000400000-0x0000000000E17000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3816-141-0x0000000000400000-0x0000000000E17000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3816-141-0x0000000000400000-0x0000000000E17000-memory.dmp
-
Size
10.1MB
-
MD5
658dfa09f77681ab8cb689c8805afc26
-
SHA1
d80b69e182305280b042d5fbf607862604ac45b8
-
SHA256
8f57b61f9c81a6da923b94e47711385a2584a8d69499ebf769661ebe577e3ef7
-
SHA512
b3158003f7b3503d6b1bc0653f44cf0bf92f645b2df7a98d4a15edddbc2d8adc59a413b84080c99501932c4db86b50a849e1502e2dd75752305fec0c1458b610
-
SSDEEP
196608:8w3SbNMQBfjyUJcZL1iIilMKJavg7SY5x7MAsbbrQ445Fwx95kHt8ESZhY3ko:8w3ZQVx6aL6SOY3zYs25St8R
Malware Config
Extracted
raccoon
12b578c7e84cde40470e7033ed07e072
http://37.220.87.66/
http://77.73.134.0/
Signatures
-
Raccoon family
Files
-
3816-141-0x0000000000400000-0x0000000000E17000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bYRbd0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.bYRbd1 Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bYRbd2 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 73KB - Virtual size: 73KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ