redline | 1300-58-0x00000000020D0000-0x000000000210C000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1300-58-0x00000000020D0000-0x000000000210C000-memory.dmp
Size

240KB
MD5

9a3d3d6a77fff7916c51e663dd6bbb69
SHA1

c081aacb14b4b69a4a0906cc86f181762c764e17
SHA256

191adc743118ef7d9b9c8888952a3a1bb351019fb7339aea2d3773b7d5519b8f
SHA512

78b0ed7b9d32cbdb6dee0c7a7b70c37b18b228e66d71264ce2bf9e580d894b28b0b9d2f75a0fca6f9f5c61d2ce59c186f2be150f7038bc42b0ec966e0b33765f
SSDEEP

3072:6jq7LmeBQr+TR/Md3ej2sfpqltOMML3oe/Zgh+hxjOLhFrQ9qmAPv5f:6jq7w+Wd82sfpql0M5+hOhFUM

Score

10^/10

testing redline

Malware Config

Extracted

Family

redline

Botnet

Testing

C2

46.3.199.124:27968

Attributes

auth_value
2e03f2e71c0fde73929d6d088968e2de

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1300-58-0x00000000020D0000-0x000000000210C000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ