Static task
static1
Behavioral task
behavioral1
Sample
3284-133-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220331-en
Behavioral task
behavioral2
Sample
3284-133-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-en-20220113
General
-
Target
3284-133-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
8c03ac049ffe6e842645fafad7178214
-
SHA1
8cd8d48f30e57fda36fcc0d4dc34aee6057f91ec
-
SHA256
11048cf889356ec5b06ac824b8a04c433f90ebfed9408fd2f9e38bfe18f1740f
-
SHA512
861bbd4526e88219e3cdbcbc01e6ad4c56111314b20219cbbea5a800b1bf502934f1116684d7f3e4f7e102d15eed552d22ad0a3308ba14173cbefb48fb5cc314
-
SSDEEP
1536:gRxakCr5Q2IlAJcGXh4SQtr8x+UULrf4HLF3vumlbuZgV37B30wuei6ILZ:wCr5QKT8LUULrf4HLR26ZLB3hed
Malware Config
Extracted
redline
@ansdvsvsvd
46.8.220.88:65531
-
auth_value
d7b874c6650abbcb219b4f56f4676fee
Signatures
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
3284-133-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ