Behavioral task
behavioral1
Sample
776-83-0x0000000010590000-0x000000001060F000-memory.exe
Resource
win7-20240215-en
General
-
Target
776-83-0x0000000010590000-0x000000001060F000-memory.dmp
-
Size
508KB
-
MD5
002bc8e4a7de695a06ff15e8a3751fe0
-
SHA1
9943f3802f41accc2bfcb0b9488ad9f6e823b93f
-
SHA256
e52cab73ec5add1a0f329a2bf75a36fbb677b0f55b0d0141b94214725b9624f3
-
SHA512
3a72e298cbb2dea8fc3baae1fe67b2e1fdc66d75c293372cb9606e8634bf408532ffa7b0d13277573e2b8a0fd84629e29d556140583306057861243618a9427a
-
SSDEEP
6144:RXVUvr+eNVx6JuGD5To83sRnymABKtqulRwOJfZJEfcZdC48hAiWsAOZZ8RX7mck:RX8/Vx65HCnDAByqulR1fZJQGs/Z8
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 776-83-0x0000000010590000-0x000000001060F000-memory.dmp
Files
-
776-83-0x0000000010590000-0x000000001060F000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 465KB - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE