Behavioral task
behavioral1
Sample
145012-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
145012-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
145012-56-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
f2260a3f7c107646c2ec9a128f20310b
-
SHA1
706f2245c6498ceb116d7cd8fece3f0ce2f344bb
-
SHA256
e93c9b1411f256b3708f35297fd2c88b8c2d3285b8a447016a8a9bd7ee71ebcb
-
SHA512
4ae801ba52cee05c3da37785f5aacb52e674aa35427d09f74e270da99090723d8b84c06c2bf4ae2389095d38d08056d2757219dacb5523198a269143035816bd
-
SSDEEP
3072:0C1sO0XHUKYnF96nl6ZjT1sp8REu7Wehta:nsOxml68p86eh
Malware Config
Extracted
redline
185.215.113.83:60722
-
auth_value
96edc2d9e7f2e01ad3f59628a1517bec
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
145012-56-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ