Behavioral task
behavioral1
Sample
1968-62-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
1968-62-0x0000000000400000-0x000000000041C000-memory.exe
Resource
win10v2004-20220722-en
General
-
Target
1968-62-0x0000000000400000-0x000000000041C000-memory.dmp
-
Size
112KB
-
MD5
de4dc2a3ac510ba5cdb6350cf54d94c5
-
SHA1
58851f7b7577d80c0d8658e48522ac3de812a243
-
SHA256
9be864e4830acea9678bdb63acb3a8ab17ea178e82ab92aa5997b5e5d21e45f8
-
SHA512
58987235e4ad1484d525d868837474f094f9923b38a324f5172989ee197f07cb3dd819e10336478b4a652ce164d0fb822b2f658046a22616dd26570932aab29d
-
SSDEEP
1536:BbFrZPEsPfQvzUWYV/J7q4q5pdzfy3d1AsFuypCVPnUSQ93VraYb3ArH+Xoi5bR/:25veYy31CVF23VGIWHri5tyddhzW
Malware Config
Extracted
redline
6allsupp
jbeaef.ml:80
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
1968-62-0x0000000000400000-0x000000000041C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ