Behavioral task
behavioral1
Sample
2092-2-0x0000000000400000-0x00000000004ED000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2092-2-0x0000000000400000-0x00000000004ED000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2092-2-0x0000000000400000-0x00000000004ED000-memory.dmp
-
Size
948KB
-
MD5
7fa28f29e5739211a0aee1873487fb66
-
SHA1
6868bcca60fe5c23e62f213127ea8a3412b88761
-
SHA256
db11e60b08e1ddc07bde1ee6d27fcf275cd0f25e2ac32b1f38694f650eca5e3b
-
SHA512
0d87337497046f66b329f4d2dc70075c95505f035cece570de4b08609576eace93f104c21b717608a41b0f9045c62be85e487b2eb56aea9892bcb01ac34d3147
-
SSDEEP
3072:yEfIr0usN5rtB+U7ITo+StuTErFDYpcONgtjXGNgC9vGKo4Ek6miS5MpoXTzj:yyttI0PtXRYobGNgAGn4EzLyXT
Malware Config
Signatures
-
Raccoon Stealer payload 1 IoCs
resource yara_rule sample family_raccoon -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2092-2-0x0000000000400000-0x00000000004ED000-memory.dmp
Files
-
2092-2-0x0000000000400000-0x00000000004ED000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE