Behavioral task
behavioral1
Sample
103144-1467-0x0000000000790000-0x00000000007B8000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
103144-1467-0x0000000000790000-0x00000000007B8000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
103144-1467-0x0000000000790000-0x00000000007B8000-memory.dmp
-
Size
160KB
-
MD5
f394c14f4dfb94686b00be11205697db
-
SHA1
3f9f3951bcf544426db50bc4943b8785761ba707
-
SHA256
6c6549bff5c8373d32d9324ccc84f9ad397e969425807abbe40ab0c0afcf6557
-
SHA512
d7667da7ff680472f3c614cd98a5086fb08baea7c0304badf7aa338f5e7d45436d8b951962608d5ab4545b96afdd738d40e15177e356ab02ea068cf983f53612
-
SSDEEP
3072:nYO/ZMTFP3wICjEYJ02WGy5UVVlDFTyRPQhhSSDp:nYMZMBP3wIxq02Wv5U98pQh
Malware Config
Extracted
redline
11
77.73.134.27:7161
-
auth_value
e6aadafed1fda7723d7655a5894828d2
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
103144-1467-0x0000000000790000-0x00000000007B8000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ