Static task
static1
Behavioral task
behavioral1
Sample
345216-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
345216-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220414-en
General
-
Target
345216-56-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
b4fa50bdff3e474e9ed9cef73b86556a
-
SHA1
2ef9c880c521cf1b19f3d270850da88eaac1c5f9
-
SHA256
88f76cb2ab62812bf1aea77b90d30be207048a9c7d7cbbab3b59ad312f9927e8
-
SHA512
34350fe451c2b83a92393865de580a60e30c9e1984e987dd9ce1de9f552cec30518b4009ace9218057f63b28c573874b704bf1297a64cd08c32b9d5921c639d0
-
SSDEEP
1536:Mg+zC1sQ0XD9bYkuCHB9gZj0F8/ALAF6ZOzNa+WcabRXdbuMZjdKWQ0wuei6aLZy:uC1sQ0XRUkuNH/N6wzNaD19FQWQhYg
Malware Config
Extracted
redline
opzxusdicnk.tk:19998
-
auth_value
a5f9e7d6dd9b8e28760b65fbb8328870
Signatures
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
345216-56-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ