Behavioral task
behavioral1
Sample
2656-0-0x0000000000900000-0x0000000000DD7000-memory.exe
Resource
win7-20240221-en
General
-
Target
2656-0-0x0000000000900000-0x0000000000DD7000-memory.dmp
-
Size
4.8MB
-
MD5
55595d3e16a08863c80e0df63815d053
-
SHA1
8e1d138079050a2cea0c7c4e1a2f9011f7d6709a
-
SHA256
0106b2ce89faaab9e6918999dfef73d90b3aa5adf997ed8805bbbb35a1b295d2
-
SHA512
1c15cd7a584a33420b5713b671bb27204d4a562348705f4a9911b09fd44c617f6f4633967e167b42d9a81f9aad4048646d547ed06efe09200e4e051e9a8fb3c1
-
SSDEEP
3072:5ZZW2F6MZD13bBYTxxNnpiXeiDN/0qCUt0l3xooPL007mBBLD4B6DJKJOW:jE2weDW3piXeiDNS3Tw0qBLDvJe
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2656-0-0x0000000000900000-0x0000000000DD7000-memory.dmp
Files
-
2656-0-0x0000000000900000-0x0000000000DD7000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 181KB - Virtual size: 404KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nkxbjlfg Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kzjaljwy Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE