Behavioral task
behavioral1
Sample
3084-340-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3084-340-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
3084-340-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
0bdea35de1bbf589f017aeae0e40f908
-
SHA1
7a0beae8768aa07b72594ac33927ed6f427ffe9d
-
SHA256
968c11809897704ccb3a3be337bd0cf8cc3ba0243901f6cdcd5250a8f9e5bd40
-
SHA512
00c2733ac0690a54bf333092d8054b3e04af3c34309879e0ec934e89a01cc47a7e545db5ca1a93552d21ffe84d1d614fb0f6468a3b6287e01673d99ae7efddbb
-
SSDEEP
3072:/YO/ZMTFLbSI4r7Cp8Ik5A0VLaVvDFo/RXThkSSwY:/YMZMBLbSIMo8Ike0VLq8BTh
Malware Config
Extracted
redline
nam6.5
103.89.90.61:34589
-
auth_value
ea8cbb51ed8a91dcbe95697e8bb9a9d7
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
3084-340-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ