Behavioral task
behavioral1
Sample
98444-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98444-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
98444-56-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
99c84f87d6057860d2ee222165c0ee7e
-
SHA1
b7c2fc053714efb3b304b065177c2ce1a4861486
-
SHA256
ff9cb076dc982de7d0334dbccc2f26ee97dabbe9a0ad43a1d7d9ab671e2f76c1
-
SHA512
7beae79b8753507f3328f443c320bd3b614e7878fdda0ebe6cca9c1dcb1066f3d537df9d5e3c2d551a8e61229f8f8c9cbfb23077e0a87c1f2519a4cccc97b716
-
SSDEEP
3072:0YO/ZMTF02ZUB71eKd+gQ+5FVjDF/yRX1hISSHh:0YMZMB02ZUTDdhQKYB1h
Malware Config
Extracted
redline
@EBANIYNOYNAME
82.115.223.48:26393
-
auth_value
3517499b9df589c8c64f775931cb7b6d
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
98444-56-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ