Behavioral task
behavioral1
Sample
2224-150-0x0000000000760000-0x0000000000788000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2224-150-0x0000000000760000-0x0000000000788000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2224-150-0x0000000000760000-0x0000000000788000-memory.dmp
-
Size
160KB
-
MD5
5969550fa5b5abc4db85f5029b84e687
-
SHA1
91680bf721f2bbcc19dc9f09b943be3986813633
-
SHA256
a7837e6c58741b8167e66ac67622d7efd6da8e5d0d19dd5a9985cab08a7091fa
-
SHA512
380ff9ec66fca68f244e572d83bcd5a558485c013165eaaadfc966b76fbb849a59013a864da7a24ac9755e7c614d10655586bb32eaac2fdba45ea93d48b17fad
-
SSDEEP
3072:JYO/ZMTF/H+IQjWbW0+Hx4OYB1VlDFuyCX1h6SScq:JYMZMB/H+IFSdx4O89L61h
Malware Config
Extracted
redline
04.10 docx
82.115.223.18:47594
-
auth_value
8b4992996780a35a82f2dbdc1a497f08
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
2224-150-0x0000000000760000-0x0000000000788000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ