Behavioral task
behavioral1
Sample
2296-229-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2296-229-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2296-229-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
8f359930e20b0ec1cf0f8da0bdb90b72
-
SHA1
e337b4d5a385f9cadad27edf327266bbd5a31d3b
-
SHA256
f523bdf335913efa1301aaba1ba10e7a009888fe88e49dc7f558cc82406e3791
-
SHA512
a2582433aa91c3a42a00851c06b6f0527cffecf0f9febe62fd6d54728a8cff9917532316a854bff0ba31739f22086f0cd1264a7e32fda585858391d9013c5d99
-
SSDEEP
3072:3ZEqsAbLjlp5qce3lPW7aOk7L8rPVhIJvA:yAbLjlp5qceBYa33+
Malware Config
Extracted
redline
srtupdate33
135.181.129.119:4805
-
auth_value
b69102cdbd4afe2d3159f88fb6dac731
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
2296-229-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 98KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ