Behavioral task
behavioral1
Sample
1072-203-0x0000000000BC0000-0x0000000000C45000-memory.exe
Resource
win7-20231129-en
General
-
Target
1072-203-0x0000000000BC0000-0x0000000000C45000-memory.dmp
-
Size
532KB
-
MD5
f331d3c0ac95df58a0dd682a2fddc1b4
-
SHA1
be16f27c8bbef1dd6a0aec31c8fdb5d1d5acdaa5
-
SHA256
f5287919e0d08035434d2ce9b5bb70559b0f7af96ad74b38f05f6925c3ac9500
-
SHA512
7f5510b700cb50ae0fac50028e536276291eeb2f94b60c3be5c817b9f2761a7f92a7babe6c5a519f6efe51a60b9cfc8b7942e9120d3301e151cffd85c6ef8308
-
SSDEEP
6144:N1EwL0xQk9VdeLuVnQs8QLgt8cBvnkCX/3Rde+A+DdsAOZZiXXPcN5I2OhX:N1EZT90uNQzYgScBvnn/XpTs/Zi2OhX
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1072-203-0x0000000000BC0000-0x0000000000C45000-memory.dmp
Files
-
1072-203-0x0000000000BC0000-0x0000000000C45000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 481KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE