Behavioral task
behavioral1
Sample
832-92-0x0000000000080000-0x00000000000A0000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
832-92-0x0000000000080000-0x00000000000A0000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
832-92-0x0000000000080000-0x00000000000A0000-memory.dmp
-
Size
128KB
-
MD5
3192ad2bd7eb1e1eb007819ca4ae2a10
-
SHA1
1871244fd1a94d3d612aecd0fccd41c81e944fba
-
SHA256
214c29b70ef187827b139920b34bca9332bda7099f8a163b6a8326d6f9e8b52f
-
SHA512
1754861fe7f207312c749e5e72656b609a8de8f30c7b11a6c1ca1943769308d97e45dd068c68eb234a037e98f4e955eca08586ba6b5e3bd2117844ba5d2b32c8
-
SSDEEP
3072:4cvFBQCYCpiSIPj/j732jOpy7cwcuTgh+4EASN:4cvO7T32y+c2gh+4jS
Malware Config
Extracted
redline
Mant Pirate
185.222.57.238:27519
-
auth_value
82d8a28b8dcfaa5f68b8c7b8a8f7c64b
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
832-92-0x0000000000080000-0x00000000000A0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ