Behavioral task
behavioral1
Sample
100712-198-0x0000000000410000-0x0000000000438000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
100712-198-0x0000000000410000-0x0000000000438000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
100712-198-0x0000000000410000-0x0000000000438000-memory.dmp
-
Size
160KB
-
MD5
d6f7f324a7f90e0019aa0cf39aeb12aa
-
SHA1
01caa61ee72d5ecd7ed7312c03523fccafbae3e8
-
SHA256
b0f7251aab8213e1afda328e2d10d4e5b7ee4ef01c3d17da554b6e3d55c7405e
-
SHA512
3c3015965e3b766dca1f3f89a020cc7570b445403f9ef862245942452fc9d08723c90764b5045c9596a213ff1e31b75e8092b89499e0313cf9c216ce297aa360
-
SSDEEP
3072:9YO/ZMTFap2o+7O44WBeXt9VBDF7yNP6hiSSLT:9YMZMBap2oT7WcXtRQN6h
Malware Config
Extracted
redline
555
45.15.156.8:16839
-
auth_value
f2ac34cb1c86d7191bdcf219521dcd52
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
100712-198-0x0000000000410000-0x0000000000438000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ