Behavioral task
behavioral1
Sample
1828-145-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1828-145-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1828-145-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
4fa3f2e10fe9abf0971bb75f6d583997
-
SHA1
44efe62ba5b449319062ace36814b19d8e054dd0
-
SHA256
6367e14ef8a03717ed27df1b65d8e7b3704d12a81ea10401dc95928b5c883e1e
-
SHA512
8516bdb2361051c75f6a74357d7277f9ddfa342ee93098e6b6ad0b47bb6a633b3afe26ecfe0fbccada6d3927c024b4a425df54cb581401ef132ba8b1893f7bac
-
SSDEEP
3072:yYO/ZMTF9ZGIn7+hXzVuDQLJ6VMDFGjRXFh/SSxA:yYMZMB9ZGIahVuQvyBFh
Malware Config
Extracted
redline
me
92.119.112.239:28769
-
auth_value
0b41ed1bdf04c7505d47398771081370
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1828-145-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ