Behavioral task
behavioral1
Sample
1948-519-0x0000000000400000-0x0000000000425000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1948-519-0x0000000000400000-0x0000000000425000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1948-519-0x0000000000400000-0x0000000000425000-memory.dmp
-
Size
148KB
-
MD5
3ffc69ec7f922d9045aeddddf337f7ea
-
SHA1
8c8b23f8a6f3eae1c97763a632688d10ecadfc6e
-
SHA256
7c5943ffc0be7de2cd77f3ef02b2921df94f9d966e2d95f2ec938673cacb59fc
-
SHA512
47ef48818803b480cb7d55eb389d4c01d67ddd96e29f0cdabb2a91e20f236055f150007b74641444acd0bb55d8ea2b097aba2d26c85fd533bdce078cfb3c2d09
-
SSDEEP
1536:GY5KCXch1xZEVQnPjUMg0XfXBOwbzR14iwelTKMTarb57b8CBm0DasBIdPKz0sex:1Xch1x0QPtfEwP/wUaR7b8CBmChIZKi
Malware Config
Extracted
raccoon
fc8427198f843d72c1aa8a66db1a98f3
http://91.235.234.235/
Signatures
-
Raccoon family
Files
-
1948-519-0x0000000000400000-0x0000000000425000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ