Behavioral task
behavioral1
Sample
3624-148-0x0000000010590000-0x000000001064F000-memory.exe
Resource
win7-20230220-en
General
-
Target
3624-148-0x0000000010590000-0x000000001064F000-memory.dmp
-
Size
764KB
-
MD5
a23b70dd9f0fce9093c43f0322249e5f
-
SHA1
1f38e1dae7a3374ca6a6686205b047c2ab423460
-
SHA256
9792958cff2d41bd7e00da58539ab10d8d9808494cb5a93cf0684720fc22c9e2
-
SHA512
9c3698091f8b0e53cc9c360a7effc540bf3adf71933351b905ef4cdf1432f33b8839515ff81dc1dbd9f153b4c11b66befeeb8a392e440966b4c11acbbcb277bf
-
SSDEEP
6144:pXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hAiWsAOZZ8RX7mck:pX8/Vx65HCnDAByqulR1fZJQGs/Z8
Malware Config
Signatures
-
Remcos family
Files
-
3624-148-0x0000000010590000-0x000000001064F000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 752KB - Virtual size: 752KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE