redline | 1600-79-0x0000000000860000-0x0000000001084000-memory[.]dmp | Triage

Sharing

General

Target

1600-79-0x0000000000860000-0x0000000001084000-memory.dmp
Size

8.1MB
MD5

241e7da27ae2cc1e17a8d9fe53d2620a
SHA1

fa832ccd8058ff2444c4239679e9eb9b0bf29022
SHA256

eaa8491a34f287f983588eeb182cb91b753d24c4218f1a4c429c619441449635
SHA512

06c43b61180c15be7252307aed202fbe0f4356651330b0455d1de315e163b7ed2ca633a26710d24e8935554445354c1e994eaf911c335e89ebc757ec44dd65db

Score

10^/10

themida 1877 redline

Malware Config

Extracted

Family

redline

Botnet

1877

C2

hawler.duckdns.org:56199

Signatures

RedLine Payload 1 IoCs

Processes:

resource yara_rule

sample family_redline
Redline family
redline
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
themida

Processes:

resource yara_rule

sample themida

Files

1600-79-0x0000000000860000-0x0000000001084000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ