Behavioral task
behavioral1
Sample
2880-1-0x0000000000400000-0x0000000000657000-memory.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2880-1-0x0000000000400000-0x0000000000657000-memory.exe
Resource
win10v2004-20240709-en
General
-
Target
2880-1-0x0000000000400000-0x0000000000657000-memory.dmp
-
Size
2.3MB
-
MD5
3337764e1a94140081222ccee2af97e9
-
SHA1
7ef66d3fc1466683224be9334f7daecb446ec82d
-
SHA256
e883248c6a9521c8147a46033de34403a3e5734366ec53cb257c5bb9e261438d
-
SHA512
95dad3d173f2cf4e8e57983d17f160f91f2858b90ee7ab200b8f6c5ede20a5bf818201ad8fe526757d60b7b6c7cd16a86ef08a8b73cfad455ffb6e9150b56768
-
SSDEEP
24576:fjimlsUZs/yP3pgXWeoVeVph4UsKX8ctGeQQnuyZvvUhC+aAUZDuSqeU1aD:tZayP3pgXWFVeVpPscAQuyZnk5DSqpK
Malware Config
Signatures
-
Remcos family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2880-1-0x0000000000400000-0x0000000000657000-memory.dmp
Files
-
2880-1-0x0000000000400000-0x0000000000657000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 724KB - Virtual size: 724KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 352KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ