Behavioral task
behavioral1
Sample
95300-56-0x0000000000090000-0x00000000000B8000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
95300-56-0x0000000000090000-0x00000000000B8000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
95300-56-0x0000000000090000-0x00000000000B8000-memory.dmp
-
Size
160KB
-
MD5
d120a071785f2fc022ead3cf507f9ba1
-
SHA1
b16ae0c00b7e1c63e32a388c8a8d6a905d2acc07
-
SHA256
6e314bbeacacff99954e380784a2cf56811e5ecb8f6fb9dcaad54e6213e6608a
-
SHA512
f1c52c8a2337e118cc0ea804acc2c59c1359c744854af177a8dd574641aa6768e44635b758d75921b12655b5bc9deb89b0f0e6975d96d4a6d1411ebac4eeb349
-
SSDEEP
3072:+YO/ZMTFe14IYzQCNOfkCkBHtgVuDFNyRXJhmSST0:+YMZMBe14IHsOfkCkBHtFSBJh
Malware Config
Extracted
redline
@forceddd_lzt
5.182.36.101:31305
-
auth_value
91ffc3d776bc56b5c410d1adf5648512
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
95300-56-0x0000000000090000-0x00000000000B8000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ