Behavioral task
behavioral1
Sample
2012-58-0x00000000020E0000-0x0000000002128000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2012-58-0x00000000020E0000-0x0000000002128000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2012-58-0x00000000020E0000-0x0000000002128000-memory.dmp
-
Size
288KB
-
MD5
0e19f83e6c0c9a67734df0e4b348ad5d
-
SHA1
15fbde21b51c3d4b15c6f53a470fd517a867935c
-
SHA256
2e80f2396e9a389073a5507deac90503af800d43a4388610338658d813a402ac
-
SHA512
b03d6a8aab14eaaf818c6fe89463463a50a36c119c86ce8378476ac5fb2e6644c64028cadc3bbe321170c644a3ab998ccc318eadfe95388aad74290abb32cb4b
-
SSDEEP
1536:iXCTBir+/R1BKyJoYGZw2In3cft9VlQ6Xceh23pDsqUbYCF3A9+CEKFwShzyd9Dr:iGB6a2Sn3gzV32sjHwkLqYdkrzpiuk
Malware Config
Extracted
redline
fivem
fivemonitoring.com:80
-
auth_value
fff7de14b88315db0636624183b17a2a
Signatures
-
Redline family
Files
-
2012-58-0x00000000020E0000-0x0000000002128000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 159KB - Virtual size: 158KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ