Behavioral task
behavioral1
Sample
2976-149-0x00000000001C0000-0x00000000001DC000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2976-149-0x00000000001C0000-0x00000000001DC000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2976-149-0x00000000001C0000-0x00000000001DC000-memory.dmp
-
Size
112KB
-
MD5
f5e6f2a358c3205a6ce82b201c1333ef
-
SHA1
b21c1613ff5093ba0c9de735b0fed3270ba85b3b
-
SHA256
daa27076aff3377ee5e58d0982b2c811f1821d31a60b16070c4474cd7c08a7bf
-
SHA512
64f2aa9c217764967432b9fef911458f5762c2cb7138910e2b9643dd26f6d539b9adc33f9b46671aa0ecb56db6d5788dea83b7fa532a8e1b2859633130e33666
-
SSDEEP
1536:uPqUPY5gyWjddJg3ZnubDNtieWDN+DNwNDaDNKiuRjyCYDN1jviDNPaQJ72oPMlI:J/u+eqOaJiJlyb3yCWLIp
Malware Config
Extracted
redline
Lyla.11.09
185.215.113.216:21921
-
auth_value
a1e5192e588aa983d678ceb4d6e0d8b5
Signatures
-
Redline family
Files
-
2976-149-0x00000000001C0000-0x00000000001DC000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ