Behavioral task
behavioral1
Sample
4692-132-0x0000000000470000-0x0000000000490000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4692-132-0x0000000000470000-0x0000000000490000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
4692-132-0x0000000000470000-0x0000000000490000-memory.dmp
-
Size
128KB
-
MD5
7a84889b1869aa7d9d5ae09156f52f39
-
SHA1
91262dbf3da79806f922ab31c50c20f1d7f1fe91
-
SHA256
ac0cb8c117f7f7466a00802202d8c0acbc1069619aa3794a339a5e97d336bea4
-
SHA512
03479ec08b21f8b2a8fd08da3e27764adb5d40cd840697d25cbea931d7e8a8243ef5105965365d35986edcb588b74818305fdda2a8dda10f238c722f2554ca32
-
SSDEEP
1536:URxNkCrRQ2IFAhcGOBmSCtz8xG9rZTcf8HqH53teFbuZgQeZ7Je0wuei62LR:XCrRQyCUD9rZTcf8HM9+VhJehsd
Malware Config
Extracted
redline
2
65.108.41.163:38151
-
auth_value
8ef2f7e3bf71e827d3411c71c9064440
Signatures
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
4692-132-0x0000000000470000-0x0000000000490000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ