Behavioral task
behavioral1
Sample
2804-0-0x00000000001B0000-0x0000000000653000-memory.exe
Resource
win7-20240221-en
General
-
Target
2804-0-0x00000000001B0000-0x0000000000653000-memory.dmp
-
Size
4.6MB
-
MD5
c51b5b786fb46f560a67068c640e4392
-
SHA1
8d22576906dfe7f6f29c14775cfb430fd83bfa8d
-
SHA256
c3305822fb8d307f8f84d6e54fb8d944e4245028df913b82944ff5e83a425784
-
SHA512
de0f3753c67979f0ae984422bcd82e83263b34a08279b7c0c03ef8e9e9f9977e4cb5f3e2cd32bf23d68d70663b78f37c1d43187eae639e8b9ae74c728d212d0c
-
SSDEEP
6144:b/SI+a1pSbDNno80Pih51PNx7QvcqOK05/:b/P+4Sp0aPNsOV
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2804-0-0x00000000001B0000-0x0000000000653000-memory.dmp
Files
-
2804-0-0x00000000001B0000-0x0000000000653000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 182KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
dbelapuy Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ynoztmpr Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE