Behavioral task
behavioral1
Sample
4716-161-0x00000000005C0000-0x00000000005E0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4716-161-0x00000000005C0000-0x00000000005E0000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4716-161-0x00000000005C0000-0x00000000005E0000-memory.dmp
-
Size
128KB
-
MD5
0c5f5ec5a805b0d991ded43002ccd529
-
SHA1
f3e33b5d74d87efa30012c6e0d6c83767bde00db
-
SHA256
2ab80377c52dc22f2cdf6776f564ec43576a8dacd5bbe9e99b61c876544f989a
-
SHA512
c836ceb11008a69e5ac7833e4ac3965ea485120b18ed7b50c3247b12df2821c9feb674c901efb192ee81aba0af89fd3bce177c5c5b2f1c41bc74413420e2796c
-
SSDEEP
3072:2cvFBICY5pidITxoXUyLs7DuQcd9jDiha4EASN3:2cv2HpyLs3nc3iha4jS
Malware Config
Extracted
redline
nam5
103.89.90.61:34589
-
auth_value
f23be8e9063fe5d0c6fc3ee8e7d565bd
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
4716-161-0x00000000005C0000-0x00000000005E0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ