Behavioral task
behavioral1
Sample
3932-404-0x0000000000400000-0x0000000000425000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3932-404-0x0000000000400000-0x0000000000425000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3932-404-0x0000000000400000-0x0000000000425000-memory.dmp
-
Size
148KB
-
MD5
ffac667560b39e141e487ba4f16f845e
-
SHA1
ac975a2e8cdb2daa820052df0eaffa8289d328af
-
SHA256
f2965f63d863af03c70bd16d46c49b759c5173c7a1ab9504c482bbe67ad9a501
-
SHA512
8c72ca8bf1de4feefdf28c62e895d2a4c6e1d21efec6de1f808f533fcb36b30dee5abcc0b0c8d5ce2a0fa81f737c1ee85f25fc38a0e66fccbff9afccb8ef2153
-
SSDEEP
1536:GY5KCXch1xZEVQnPjUMg0XfXBOwbzR14iwelTKMTarb57b8CBm0DasBIdPKz0def:1Xch1x0QPtfEwP/wUaR7b8CBmChIZKJ
Malware Config
Extracted
raccoon
fc8427198f843d72c1aa8a66db1a98f3
http://91.235.234.235/
Signatures
-
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3932-404-0x0000000000400000-0x0000000000425000-memory.dmp
Files
-
3932-404-0x0000000000400000-0x0000000000425000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ