Behavioral task
behavioral1
Sample
832-58-0x0000000000070000-0x0000000000098000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
832-58-0x0000000000070000-0x0000000000098000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
832-58-0x0000000000070000-0x0000000000098000-memory.dmp
-
Size
160KB
-
MD5
9b9d3f26aa3a1bea994a1c70e03d5c06
-
SHA1
29543524ab7af241df3e85fa7b849f336a91d09c
-
SHA256
3ecd8b23fd7a59c8ba2e7aa42f9046bb096e24ee47903c35032cbe01bdb5b487
-
SHA512
ac846e9381259c4e7d7c5cd4b9c68b0e1930d39abdeb4860ebb49f268aa35522ef10686473e56e7b57ea60541aaf1fa93beae751e8a8964094170ab9b4c2ea9d
-
SSDEEP
3072:ZYO/ZMTFgnAILj04cuRFcDrrrrc/VitDFzyRXlhfSS:ZYMZMBgnAI8zuRFcvtUBlh
Malware Config
Extracted
redline
crtest
denestyenol.xyz:81
-
auth_value
ac9c5d38bbc1b733c499deeab5940e0d
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
832-58-0x0000000000070000-0x0000000000098000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ