Behavioral task
behavioral1
Sample
2180-0-0x00000000013C0000-0x0000000001884000-memory.exe
Resource
win7-20240708-en
General
-
Target
2180-0-0x00000000013C0000-0x0000000001884000-memory.dmp
-
Size
4.8MB
-
MD5
0218edb491c7d9fc831a5320151a6f0c
-
SHA1
b47cb17a70db633e0a8c7db75c888ca131478e41
-
SHA256
b9323af2f39ab95422091b50f79048753989bccf2b973b007434c184cdfffada
-
SHA512
b7ccd8415d98267e6ce6c16b9ec1f9beed70ef15eef440da0a3b97ce8051aeb755a3d05d90bd9b859c33472c218731bf818f060a1a81b4e8fb32b9445b20888c
-
SSDEEP
24576:+kuI1LoTycFQuVV1qQkfA+6388qVqnJCZZQ1njd7sx0:3h1UTVQsTq9o+6Mjq4ZS7sx
Malware Config
Signatures
-
Amadey family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2180-0-0x00000000013C0000-0x0000000001884000-memory.dmp
Files
-
2180-0-0x00000000013C0000-0x0000000001884000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 183KB - Virtual size: 416KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
nhcsgksu Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
igwlhnet Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.taggant Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE