Behavioral task
behavioral1
Sample
4640-194-0x00000000105A0000-0x0000000010624000-memory.exe
Resource
win7-20230220-en
General
-
Target
4640-194-0x00000000105A0000-0x0000000010624000-memory.dmp
-
Size
528KB
-
MD5
83c241e573a36b88a84cb54b46805de2
-
SHA1
c0c39f9c0ee4ac9f8b4d970092adb800a5ea336b
-
SHA256
9905908fa0f75d1e6f0bdffe545fe750b2a0461e33985f33ab4c6cd5c5aaba89
-
SHA512
934b0263a486944dfa0482fa9de047a99a7f5ba0e1ac8279ca8fccfb887bf24dacbf6db97781764eacb522adf78cb80dd352e2088658153ebf3a8cc56981f8fd
-
SSDEEP
12288:HRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2zDU:Hx7cyF2eSsewS8W47eZO
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4640-194-0x00000000105A0000-0x0000000010624000-memory.dmp
Files
-
4640-194-0x00000000105A0000-0x0000000010624000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 483KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE