Behavioral task
behavioral1
Sample
1480-78-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1480-78-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1480-78-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
5d800b4915b7433b45d4a498caeeaac4
-
SHA1
b9fa8796171287233392d1856e2b6b147e0fa59f
-
SHA256
c4b2182cf8ed28a6a8e1e7ce98a918e8c450dcf4e69ba0a710842180e7ed6225
-
SHA512
21cb593e795053613b70b0b4a5e859693b2c19bb2d78f555e9954b142e88114342b481c2ef5f099d59d6ba951a823866d144709993e98ffe3400619a8df02665
-
SSDEEP
3072:ZYO/ZMTFNZGIn7+hpKkguodKqVcDFyyeX6hQSS:ZYMZMBNZGIaFguodKlzO6h
Malware Config
Extracted
redline
Testing
46.3.199.124:27968
-
auth_value
2e03f2e71c0fde73929d6d088968e2de
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1480-78-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ