Behavioral task
behavioral1
Sample
147320-170-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
147320-170-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
147320-170-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
b8c3170012a55917539abfb058689dba
-
SHA1
73381c90578ce1c22b4ffb08ad15d5e219f71514
-
SHA256
6c50583cbd660a280b02f2985ac17d1745bf8eef6fa81b899e62e5c21fb15f19
-
SHA512
c62702b6ee2cd5c2514158415b68ecdcd667b9cbcfc410390d21c207b618741cc92a89309ac75240c67e37e83bdb2fb7622a6fb41f3e37530481800c08a8d0f6
-
SSDEEP
1536:oxGETCdhRendsAaO/7DJ3Ivv7RTScOc7qFk8pfAUO+bG7buc+VJPji4d0wuei1/y:sGEguEkmQNceFk8hAF+CnFOFi4dh0qn
Malware Config
Extracted
redline
193.106.191.160:8673
-
auth_value
b452e7074eb79e37fc942576d3e3c701
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
147320-170-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ