Behavioral task
behavioral1
Sample
2872-0-0x0000000000920000-0x0000000000DB1000-memory.exe
Resource
win7-20240729-en
General
-
Target
2872-0-0x0000000000920000-0x0000000000DB1000-memory.dmp
-
Size
4.6MB
-
MD5
5f70fad6204feb94ff0e4244e6ca7334
-
SHA1
4dcf58c353055f6bbe4b05613900cb99dc94f102
-
SHA256
2801970f38c02c0ab16b23976932f07d80e52779509850a55cf7b95af31e9601
-
SHA512
4cb58becba7f4fc1a5173c8114f372ef5b2156e7372aaa4c7fc521d445e088a7eccad686a51bcb09ce7219a371e4731cdf4c58c5a4f2a9bc9cd984bcdbc7977e
-
SSDEEP
24576:eWC2lv8+8m9x5iRHdyCp/cqCtnT8JbhUn9Oy5:Y2V80x+HNEqCOQns
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2872-0-0x0000000000920000-0x0000000000DB1000-memory.dmp
Files
-
2872-0-0x0000000000920000-0x0000000000DB1000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
agndpcnp Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
egrhvtkp Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE