Behavioral task
behavioral1
Sample
4568-152-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4568-152-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4568-152-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
81c0dc771e62cd08ea628f4e38fa94df
-
SHA1
269b9f849e837c635f21df03e21b1cf0e7ad29cc
-
SHA256
f71a1c16be1f792108c1dbccfd4ad5803ccb16adcbe1bd9e843d3028e66f36a2
-
SHA512
0d46e123325ee8d2cb7a5d75a70b1cad633885219bc7c4d687ae2f8fccbd28d4c78b5df36ce327f62222f279aeeac987dcd4c32e1807c8b790f0d9c4f038d887
-
SSDEEP
3072:JYO/ZMTFy6t7FTc5t9FWIcXV/DFBYRP0h/SSAp:JYMZMBy6t7Kr9FWrlsp0h
Malware Config
Extracted
redline
Mun
yaterirennin.xyz:80
ncoduryllixe.xyz:80
-
auth_value
59a7bb64bbc9b0c25a1406a188f55bf3
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
4568-152-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ