Behavioral task
behavioral1
Sample
328-227-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
328-227-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
328-227-0x0000000000400000-0x000000000041E000-memory.dmp
-
Size
120KB
-
MD5
e4c6df1e426d77898e0883c2b5a4bd1d
-
SHA1
252a0022e35e2fd773db9a5f42b6d1ff33e01ad2
-
SHA256
b09c04a96a02a9b17ea0aa5a0e5a3a75f5d2c8a9c1e8d89f0e507173b1570873
-
SHA512
3c2e91c665adab45c40147391970ae6c5402f4ffc7aa0c1d67b2d5b8fb8c21eef0492771f8b38947525006d39253fe1bf76d943a30ec1d164cee091e095b19c1
-
SSDEEP
1536:Dm386AEAuxyTBxk9Tk1dfENlB2zzleQzOz7GgbueJvzuvNyAsd+xi1xQeTEKG6W1:Di86AdGySwXfDeQzE7xzulyddtsv44
Malware Config
Extracted
redline
2_8_r
zertypelil.xyz:80
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
328-227-0x0000000000400000-0x000000000041E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ