Behavioral task
behavioral1
Sample
1648-4-0x0000000000400000-0x0000000002225000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1648-4-0x0000000000400000-0x0000000002225000-memory.exe
Resource
win10v2004-20231222-en
General
-
Target
1648-4-0x0000000000400000-0x0000000002225000-memory.dmp
-
Size
30.1MB
-
MD5
7b0b1c673dbc6e214f2a932b735d348f
-
SHA1
5a9b9a57bfcb988ea418e74a7d416eff36d57f33
-
SHA256
d58a719e2763867cd7d23dabdfb0d649f2cdf6497d02edc7ff4fceb6106d367e
-
SHA512
6c6b1eb8f451b4e2dce3895eb44f8b522b47026cdf2aff511ac278ac41f67ca9198ee914a70d2e1a07d977b992a7e7bf8321445c00444d503bf6f51929bc701d
-
SSDEEP
393216:zCz9gr629VYWBjGhP98lss9NuVHhMhFq4h5kC9h/gx4R+l5iq8SI1uIb:c9grOWQhm9ghIfh5kCPIKiL8W
Malware Config
Signatures
-
Raccoon Stealer V2 payload 1 IoCs
resource yara_rule sample family_raccoon_v2 -
Raccoon family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1648-4-0x0000000000400000-0x0000000002225000-memory.dmp
Files
-
1648-4-0x0000000000400000-0x0000000002225000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls0 Size: - Virtual size: 10.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls1 Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls2 Size: 19.2MB - Virtual size: 19.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ