Behavioral task
behavioral1
Sample
4012-159-0x00000000105A0000-0x0000000010667000-memory.exe
Resource
win7-20240215-en
General
-
Target
4012-159-0x00000000105A0000-0x0000000010667000-memory.dmp
-
Size
796KB
-
MD5
35b4e91197f38ae4b4ae68fe1102483c
-
SHA1
1727dc35c50f38b6fd364ff71171af66ff32b8c2
-
SHA256
f13dc3452e5f5926ca076e04e9a2c42ac42111cb24f2e3b10327aea5b210ba52
-
SHA512
42f13bd3b6ed2ecd104b0bef81d10b29fa3a0e489f685c8d2d895a335d20e8696ba8a7bf43845d2d239ee1e36f8c4608248f551ea39eef9772d9807e89fadcef
-
SSDEEP
6144:71EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZiXXPcNp2OhX:71EZT90uNQzYgScBvnn/XpTs/Zi1OhX
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4012-159-0x00000000105A0000-0x0000000010667000-memory.dmp
Files
-
4012-159-0x00000000105A0000-0x0000000010667000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 784KB - Virtual size: 784KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE