Behavioral task
behavioral1
Sample
4172-194-0x0000000010590000-0x0000000010670000-memory.exe
Resource
win7-20240221-en
General
-
Target
4172-194-0x0000000010590000-0x0000000010670000-memory.dmp
-
Size
896KB
-
MD5
29272ea34bada33c7a733c0c67935d6d
-
SHA1
a63fcc424f85974434d20137f083fd2ae09e7f8e
-
SHA256
7dab2da58e955d3b4a0e14c6bc73931dbc7c987064e474100493e6f7d112f5bf
-
SHA512
ed0d40e8f552c6bdf9e657303805be264ab412f45282f989d4ce832fbdbc5938eb930ed3804766660635cdf786d4afac908f9fc31f9b3b1870e9d2d1029eb66f
-
SSDEEP
12288:/GAxQj0bTe04CLneHvW9rwbxs/Z7UwRq:Haj0bTe04CjrwbwZIU
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4172-194-0x0000000010590000-0x0000000010670000-memory.dmp
Files
-
4172-194-0x0000000010590000-0x0000000010670000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 882KB - Virtual size: 884KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE