Behavioral task
behavioral1
Sample
1880-7-0x0000000000400000-0x0000000000E18000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1880-7-0x0000000000400000-0x0000000000E18000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
1880-7-0x0000000000400000-0x0000000000E18000-memory.dmp
-
Size
10.1MB
-
MD5
90d1887b4dc341a7c37c7f5ef1cba9b1
-
SHA1
2bc9b7affe22d4607c76fef4796403097c8e38a2
-
SHA256
289d606b4fa85c70518fac5e9ad8fc4f87399e35e4fafa087fe68032e1094f31
-
SHA512
9c9b76237a092d68d4dd91019b7c66d5a8169314f5ad80ad97e20ac8968bf207fcf44c63fd48901d87fc7b2dcfdfe321259ca8772d942769d6879432bf87b894
-
SSDEEP
196608:EPq8cEHuTfWFyUSlgbBexyYst/oiAKmuB1RRn6TMkjXiR8lwNF:uq5EHkfWFvSlgbBex/2/oiAKmuB1RB6Q
Malware Config
Signatures
-
Raccoon Stealer payload 1 IoCs
resource yara_rule sample family_raccoon -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1880-7-0x0000000000400000-0x0000000000E18000-memory.dmp
Files
-
1880-7-0x0000000000400000-0x0000000000E18000-memory.dmp.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.MPRESS1 Size: 5.0MB - Virtual size: 10.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE