Behavioral task
behavioral1
Sample
4424-194-0x0000000010590000-0x0000000010670000-memory.exe
Resource
win7-20230220-en
General
-
Target
4424-194-0x0000000010590000-0x0000000010670000-memory.dmp
-
Size
896KB
-
MD5
a91e29e0e98d3895c45bd28867c8881c
-
SHA1
1a6d0b1f239e1399c48dafbca2f886037e226da4
-
SHA256
40d0e6c9cac6ae575353b07dde427e8260a586677173122d811fdfcf49bc9aec
-
SHA512
817327a3b41cafcef7841659a22aa61b281bc7f5336b27eefd4082897330c7efb5dd7160b71a77f519dc622ca0f4ba7e27d1b464ce2808a11f0bc59543f26354
-
SSDEEP
12288:qGAxQj0bTe04CLneHvW9rwbxs/Z7UwRq:Eaj0bTe04CjrwbwZIU
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4424-194-0x0000000010590000-0x0000000010670000-memory.dmp
Files
-
4424-194-0x0000000010590000-0x0000000010670000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 881KB - Virtual size: 884KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE