Behavioral task
behavioral1
Sample
2136-0-0x00000000004B0000-0x00000000007D2000-memory.exe
Resource
win7-20240903-en
General
-
Target
2136-0-0x00000000004B0000-0x00000000007D2000-memory.dmp
-
Size
3.1MB
-
MD5
73287a3a51411f4e70030a5ddffa147e
-
SHA1
61dc545124a878c78d9e2a5deda0d5ecd3298227
-
SHA256
48dc4392ffe9e0e37dcd7bce2536c5629329116aaad4c1c36cc5545c142d0b25
-
SHA512
bf5e99c29481e3d5e5eee7fdd5cd36d3b2d68ecb7db33c792beb0a52739fc04fc4645981364cac56a854e1a37a1d6269a5672da01ef540074170e131b7cce187
-
SSDEEP
12288:+ghb4JfKExWxstq5sfskjNtS7JASA6WQABwuFwBumAvA7CaompL5x+gGeHfk+s+7:9IvAOCx+347ZE
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2136-0-0x00000000004B0000-0x00000000007D2000-memory.dmp
Files
-
2136-0-0x00000000004B0000-0x00000000007D2000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 416KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
kogtbhla Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qjmriqll Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE