Behavioral task
behavioral1
Sample
4540-282-0x0000000000510000-0x0000000000538000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4540-282-0x0000000000510000-0x0000000000538000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4540-282-0x0000000000510000-0x0000000000538000-memory.dmp
-
Size
160KB
-
MD5
35aca6d70f2b5e3549dadd19f3fb8a41
-
SHA1
8b25e46d6f6adae752e77b1a73ac8b0e5df37a79
-
SHA256
6ac9b96404bb3451f8f6cd410f707cec289d61ff4540f77dc10ad50e21162d0c
-
SHA512
4fd5f5ea19e82b3a7ea882d5cb4c9de4ac911b05aca01b86818df73b46fba6b902fd583b28bc1755b02d7d3770b5654e9c1e61dc90b6fcb42b70ccff420a8c40
-
SSDEEP
3072:iYO/ZMTFZFoI4T1prAvzDOroVsrDF1yRPlhXSSGP:iYMZMBZFoIOUnOnaplh
Malware Config
Extracted
redline
newpatch13
lanalannnal.xyz:81
-
auth_value
b3a5f8bc32de5f2abc4d5f99402f33ab
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
4540-282-0x0000000000510000-0x0000000000538000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ