Behavioral task
behavioral1
Sample
1656-185-0x0000000005120000-0x00000000051A5000-memory.exe
Resource
win7-20240221-en
General
-
Target
1656-185-0x0000000005120000-0x00000000051A5000-memory.dmp
-
Size
532KB
-
MD5
99cb252a8f474498141df32c98e24b2b
-
SHA1
34ce989620a4c10f372ac9aebee73c7128ee187d
-
SHA256
f26d30a871671e0d01ea964d96b7da2625ca1c367a7f4595d1631186dfed6e5d
-
SHA512
4d06175a932f03a9bdde335c7060e819e3e38682b4bc56b39ebe5cdadac7411fe31dee13fa5661a7a93781a2047fccae5ec5a4f85d39d5db7899b1add44a0785
-
SSDEEP
12288:rRXxReZj3WZfj/2eSseWFaIe2+f8CL47bs/Zf269DU:rx7cyF2eSsewS8W47eZO
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1656-185-0x0000000005120000-0x00000000051A5000-memory.dmp
Files
-
1656-185-0x0000000005120000-0x00000000051A5000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 483KB - Virtual size: 516KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE