Behavioral task
behavioral1
Sample
2252-0-0x00000000011E0000-0x00000000016AC000-memory.exe
Resource
win7-20240221-en
General
-
Target
2252-0-0x00000000011E0000-0x00000000016AC000-memory.dmp
-
Size
4.8MB
-
MD5
9c4edc92dc4465fe72473b6752ce3dd9
-
SHA1
e4a09c6f7c295625388755f5cf2e6b271a93abda
-
SHA256
a8400f0fb3e81f461b98a4c205d86291904682b5a96b66519f506bf738b34d48
-
SHA512
5a720d1ae467ce2b34f1afdef12541a6e9a8c9c4435bd54c48196dc619aedfbbcbaeb7d9616d891a7d695f411dc8f8800586e61b97e275cd3f3c6568d718e170
-
SSDEEP
24576:bV/PaClSxYJQT+LzeEz2XGZ+rm3HIgigwsPmhO1JRZ:x3rlo5TmkXEJLigrFJ
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2252-0-0x00000000011E0000-0x00000000016AC000-memory.dmp
Files
-
2252-0-0x00000000011E0000-0x00000000016AC000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 186KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
gfgcliru Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
hubvxooo Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE