Behavioral task
behavioral1
Sample
796-206-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
796-206-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
796-206-0x0000000000400000-0x0000000000460000-memory.dmp
-
Size
384KB
-
MD5
a061a2dcdd9e9f7989f1d112e956bcef
-
SHA1
98ee7378d7cc9df5bff4da01f0f89cf5de461898
-
SHA256
0662bbb70f2db39d4bb38c0f26c54af3fad25bc3018e1a8d02c54b17c77a6fe7
-
SHA512
c5ddf3309bf8ad9a70e0d81d9755f8216dbb08d80ac83dad3a0626633c2f88c35ee6cc161b4b1a0dd62cd95335b83d913428aa93aa6236b486e21732101d7097
-
SSDEEP
6144:JXf85NG5ML9WSnj2ZB4lyAAi56V7KnCP2kC+9AVsDjl6yglSZiNZmF+OW57MERVk:OqiTOQyAAUi7KCP2kC+9AVsDjl6yglSp
Malware Config
Extracted
redline
81.161.229.143:27938
-
auth_value
6687e352a0604d495c3851d248ebf06f
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
796-206-0x0000000000400000-0x0000000000460000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ