Behavioral task
behavioral1
Sample
98364-56-0x0000000000090000-0x00000000000B6000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98364-56-0x0000000000090000-0x00000000000B6000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
98364-56-0x0000000000090000-0x00000000000B6000-memory.dmp
-
Size
152KB
-
MD5
7aa84bcacf98eb5c46779e20b4362ad9
-
SHA1
6bc437c9dfacb9951443759c10bb6ab2b546764e
-
SHA256
f5cc4c8654f8e8ba6cb190f437fceef3d6f51936a0b6445130672003302a1231
-
SHA512
41392a024261a6b447ced8baece560c2ee613d927e60bc29c47ed9c293a47f1be319c18cf7f66391f60b95d46686437fea98e5cc1e36d775896e5b3501041fa0
-
SSDEEP
1536:Do2zk2lpqIuEQDiTZEz5/cmmgCaTRt9Usy+OPb5L46wZEFvdAEqb8W7wM0wueikQ:c2Ymixymmg194pwW/A/eMhq
Malware Config
Extracted
redline
1609
b47n300.info:81
-
auth_value
be2b8c78370c8ccdb9160713c866e49b
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
98364-56-0x0000000000090000-0x00000000000B6000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 133KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ