Behavioral task
behavioral1
Sample
99516-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
99516-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
99516-56-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
7e6930e673656441f542fed0268985d8
-
SHA1
01b40d18a3ecdb76dfdacc51e934b672580e482e
-
SHA256
67b38da92f35888bb638845bf2bdbc39ec98357389c00782bf7fff13caabafe1
-
SHA512
129b48eb46a5b11267096156d1dc694f42114b1a39f23793782d7ca0d045a8979a65bb3ce6179e85e91a6aba7106d3d0009c3d23194ed4326f08e809ccb376ea
-
SSDEEP
3072:eYO/ZMTF+dwo4TImXDKj1VUDFSyuPLhFSS4q:eYMZMB+dwoPWDKj8TuLh
Malware Config
Extracted
redline
@cool_man717
79.137.195.87:41315
-
auth_value
d2ec1c50eaab1c677b88f377ee3162f2
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
99516-56-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ