Behavioral task
behavioral1
Sample
648-71-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
648-71-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
648-71-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
f028e8c3f2842071e3cb5627ebef574d
-
SHA1
f5bd892c59711f960f12128a681100cdb9749882
-
SHA256
7a8aba34f8d461fa06cf94712d4bff861f221fb2e5e5a2d4ca8a78928f169cac
-
SHA512
2c7febf7db7aa4c2600672fa7633296b57634d97b14d34a3ec0536ef01bfada66eade6645cc78713ebcc01c73c043e5743f27dc21b29621bae65cc3f0918c09f
-
SSDEEP
3072:ucvFBgCYJpiSI8AURI7YZWuQc5sajDhho4EASN8:ucvOit7YMncfhho4jS
Malware Config
Extracted
redline
5
116.203.187.3:14916
-
auth_value
febe6965b41d2583ad2bb6b5aa23cfd5
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
648-71-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ