Behavioral task
behavioral1
Sample
19256-65-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
19256-65-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
19256-65-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
b95a20e575860bec77d356b8d1542da4
-
SHA1
7dbf6cd39ca5138b1f421421c99cc6766e69a5b1
-
SHA256
ae485131e0d3cf67e785b54e9bc81155054afaceb92e64ee46fc11dcd3c41676
-
SHA512
43adbb63bb0cd6a43d178117f362b9c85b93293ba4205f58e5716fb94857d005b1806f51071b0e84bf952bcca868d6cf2fff207231ea28179df3589d8bf879b1
-
SSDEEP
3072:AYO/ZMTFH3OIQjGnjepFNaVMDFryvPuhXSSo6g:AYMZMBH3OI1jepFN9gHuhJ
Malware Config
Extracted
redline
PremiumCloud#39
151.80.89.227:45878
-
auth_value
67b0c0a4a5f21c8075be505887d2610f
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
19256-65-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ