Behavioral task
behavioral1
Sample
1756-77-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1756-77-0x0000000000400000-0x000000000041E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1756-77-0x0000000000400000-0x000000000041E000-memory.dmp
-
Size
120KB
-
MD5
21f90c06e6dcd4a0c7d6f7f514baf552
-
SHA1
5abd36190d7828188157e2f4fe764b9bc489a001
-
SHA256
439663c2c69fad24e86a182b29c63318c262e8e1a5525768278cd35e666c5837
-
SHA512
46f6d9e8afd14405efa39cfbccd9c1aebb627ca1ce1eac7f851cb0f3e02bbf5b1a1d5cf940fc64836e4f442009e952c1c7fe3b8e2b72f18462c64b7ae3e8819d
-
SSDEEP
1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed20tmulgS6p:XEwiYj+zi0ZbYe1g0ujyzdQ
Malware Config
Extracted
redline
sirus
147.124.223.126:4444
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
1756-77-0x0000000000400000-0x000000000041E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ