Behavioral task
behavioral1
Sample
1928-59-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1928-59-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1928-59-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
425f5f043a8bdf5d594767438ccf6b21
-
SHA1
ca5d8a2d729719023fc6ee2b2833d93bb176c210
-
SHA256
c0461a610cf3cf5ac7673c5ed1f1b7b86b9ef48aff6b2715c39ce6cf30bcb930
-
SHA512
7da32554de2c89d9319c8e83b740df97ffde8997636f7fd1cc7426efc55e2c90186278c3a97c89a560ad399520bd0bc36d884c74543d763b276ddacd6264b416
-
SSDEEP
1536:SRxqkCrRQ2IFAhcGOBmSCtz8xGQz2EtA8f4HzT5EtkCaxbuZNoxhREgL0wuei6ML:6CrRQyCUD82of4HPukCKzigLhS
Malware Config
Extracted
redline
mixmixmix
lanalannnal.xyz:81
-
auth_value
734c10d4237a679462bcff6e07f9f0eb
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1928-59-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ