Behavioral task
behavioral1
Sample
3048-404-0x00000000105A0000-0x0000000010624000-memory.exe
Resource
win7-20231129-en
General
-
Target
3048-404-0x00000000105A0000-0x0000000010624000-memory.dmp
-
Size
528KB
-
MD5
c7dac69a89b3c0f2c5ef5a6698a6f2f0
-
SHA1
7ee491d4928ff653b804b36f53a4d0eb233c39db
-
SHA256
8312d93de2cb97c0295c07ee22e873de114004a22fad1a0a74e4aa7ee389f09c
-
SHA512
25fa44e1ba891ed44e0fd63c4eee52c2caf6adbc12bf386a75386f17f622aa4bebaab88bed8ebb33a05b3c9b65bf1cfd4a04f88326f601ac1d4228944073e03f
-
SSDEEP
12288:cRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf2rDU:cx7cyF2eSsewS8W47eZO
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3048-404-0x00000000105A0000-0x0000000010624000-memory.dmp
Files
-
3048-404-0x00000000105A0000-0x0000000010624000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 484KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE