Behavioral task
behavioral1
Sample
3204-204-0x0000000002180000-0x0000000002205000-memory.exe
Resource
win7-20230703-en
General
-
Target
3204-204-0x0000000002180000-0x0000000002205000-memory.dmp
-
Size
532KB
-
MD5
497ad6ff977099b6621655b356464f2c
-
SHA1
32f8c3dead4ed857b60fc8fb10366339a2b2f18d
-
SHA256
767175342a41df61cb6b90f95209594a1a963b8d21c7a72d22d165cb6602ec3e
-
SHA512
0b548da7f829d69c663666fef2b5caba468e4b5fd1e0c3ac853ee1656555b249eecca57494d4284aaebff63d9b25150f9c25f60ccd674f6c4315e4bf697ec348
-
SSDEEP
12288:zRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf269DU:zx7cyF2eSsewS8W47eZO
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3204-204-0x0000000002180000-0x0000000002205000-memory.dmp
Files
-
3204-204-0x0000000002180000-0x0000000002205000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 483KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE