Behavioral task
behavioral1
Sample
3040-0-0x0000000000F80000-0x0000000001C20000-memory.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3040-0-0x0000000000F80000-0x0000000001C20000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
3040-0-0x0000000000F80000-0x0000000001C20000-memory.dmp
-
Size
12.6MB
-
MD5
73dcc122e8802d70912ae335b2f38f95
-
SHA1
e5b7f34d70ef407e8f2c0a52621882318912abcf
-
SHA256
3a5a531973207d4721e0b9355f6357547f509a4cfb70b8a5d9c6f95fcca86030
-
SHA512
10d17a94ce8f604912e9d8505cc9f5a8d68e823bf2cfa5626ebe62c470ccf79cd503e7281278d515d19308eb0e460131dd8bf8de211115724656bf18cab42b53
-
SSDEEP
393216:JukRLr3Z+ch+CKs1n+XS2aFUHpdpvjiOOvonfT:SfCUGFujzOvonf
Malware Config
Signatures
-
Blackcat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3040-0-0x0000000000F80000-0x0000000001C20000-memory.dmp
Files
-
3040-0-0x0000000000F80000-0x0000000001C20000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Sections
.text Size: 9.2MB - Virtual size: 9.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 351KB - Virtual size: 351KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.eh_fram Size: 813KB - Virtual size: 813KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 1KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ