Behavioral task
behavioral1
Sample
100768-271-0x0000000000150000-0x00000000001B0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
100768-271-0x0000000000150000-0x00000000001B0000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
100768-271-0x0000000000150000-0x00000000001B0000-memory.dmp
-
Size
384KB
-
MD5
5ed2e5e34210fadbdbc7020edd0d9a79
-
SHA1
278ffa6a07bf8b73bbe7a037548b1515448a0d71
-
SHA256
3843679ac6f31d9dfdce088aaeb7f080bf4b03bfee3b6f9562cdcd98dc078bbf
-
SHA512
47393974c24e93c7d4b51a3ad1daca15c15ae98e473fe91bbb0f11a8d9344c3ca3d47184cc184611b678ff943c88e858f621bd4084c71917cb1dd0928a71d4b6
-
SSDEEP
6144:NxRs09r3Qg47/AVKA4Q1LV9262XuChEuYNXSuh01UhJRJwL//9JrFdyks88mt9zh:7Z5kIKA4QRV/eAuYAU01UhJRJwL//9J5
Malware Config
Extracted
redline
@Geralt_Work
84.38.189.24:40966
-
auth_value
b3a5a978ca6c153133c1e3c861610714
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
100768-271-0x0000000000150000-0x00000000001B0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ