Behavioral task
behavioral1
Sample
102780-258-0x00000000007B0000-0x00000000007D8000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
102780-258-0x00000000007B0000-0x00000000007D8000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
102780-258-0x00000000007B0000-0x00000000007D8000-memory.dmp
-
Size
160KB
-
MD5
60938cb175333842517091523d815db5
-
SHA1
bbaeeddc617e207b2662d99981cd3e65abbcdf01
-
SHA256
7b07bcea267b219075dc1366038d839821cd645b4878a2d52cab1053b53845f5
-
SHA512
fa405e5ff7a8b1d3c8aa62a524baf315aaa9410b158337d74c4a5f0cc3b07fdae9d07e2d7baf6db017a4650793f57cee53cbb913a6fc7dab5a926e8d9d39b563
-
SSDEEP
3072:2YO/ZMTFBNaoXzCwfVGpy5VlDFwBRPGhuSShe:2YMZMBBNao+EVGpyp8pGh
Malware Config
Extracted
redline
11
51.89.201.21:7161
-
auth_value
e6aadafed1fda7723d7655a5894828d2
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
102780-258-0x00000000007B0000-0x00000000007D8000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ