Behavioral task
behavioral1
Sample
2020-0-0x0000000000B70000-0x0000000001027000-memory.exe
Resource
win7-20240611-en
General
-
Target
2020-0-0x0000000000B70000-0x0000000001027000-memory.dmp
-
Size
4.7MB
-
MD5
e2c23bff455d64a60d3e80944dfcc300
-
SHA1
a303e243a59bbdece7a4ba5999b36260c40397d4
-
SHA256
80f21a3bf52d4f79c6f1ab64972e00c28f0b4ec95592902487eb7937d0de4143
-
SHA512
e362b3333284c0290f1b5e185bc22506bb902d512857ea667fe0581fdd02fe99a0fe4c1dee48ee91f564513561587ba92d2fbbdd797b69d52c57de4a654ddc3f
-
SSDEEP
24576:EhiiLi4vMWZiGzGv/NIHWljajFn8lzaP/y5HHvP60NYG9sb:siwi7WZhzGXWKjEdsiM6LOs
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2020-0-0x0000000000B70000-0x0000000001027000-memory.dmp
Files
-
2020-0-0x0000000000B70000-0x0000000001027000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qquthdwa Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
ecpkhwjr Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE