Behavioral task
behavioral1
Sample
424-198-0x00000000105A0000-0x0000000010624000-memory.exe
Resource
win7-20240221-en
General
-
Target
424-198-0x00000000105A0000-0x0000000010624000-memory.dmp
-
Size
528KB
-
MD5
da8751af4053d0a62441d5abb5483b16
-
SHA1
ff61aac292b2e6950633658d2358f6bef1e51d16
-
SHA256
d21623194a64f42023577760beac82ddbb792a369a7efb921ec959df16de1300
-
SHA512
cf3e6bfefd5c3e0bc0a9c048b8a2af04fd5569df3615aa04bd757640c81514dff5f9a6bfee68a1ac1120e476618139261eca53bdea22666b61dec773f34d5707
-
SSDEEP
6144:OF1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZ0XX7cNp2OhX:q1EZT90uNQzYgScBvnn/XpTs/Z0hOhX
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 424-198-0x00000000105A0000-0x0000000010624000-memory.dmp
Files
-
424-198-0x00000000105A0000-0x0000000010624000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 482KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE