Behavioral task
behavioral1
Sample
76568-305-0x0000000000200000-0x0000000000260000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
76568-305-0x0000000000200000-0x0000000000260000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
76568-305-0x0000000000200000-0x0000000000260000-memory.dmp
-
Size
384KB
-
MD5
6e3bffcfd8f0c92a539787c7e11a4f01
-
SHA1
99e1421b99475242e89dbeaeed2a45e2a9753e59
-
SHA256
037c7c571891bf513efad3f17573d8b03af81cf312e1431e0a8e936834d4c77d
-
SHA512
f3dff4fee517ca123e96cbc8abc5b197f196af0243bed09edf607e84f862ec8df5cfd201848100aff796ecdeba1ce0b86566de91cea4b99991cf73f983dff3e5
-
SSDEEP
6144:S/LAU4zIe6YmPW5MeLF2lQE7oOJLdrc0Wg5HN0KVCFDvX5gFTg21jo8zKgktmaen:W8U4z4fe55B2lQE7LJLdrc0Wg5HN0KVf
Malware Config
Extracted
redline
mario_new
176.122.23.55:11768
-
auth_value
eeee8d5fcc3ba3a42094ef260c5bdcb4
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
76568-305-0x0000000000200000-0x0000000000260000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ