Behavioral task
behavioral1
Sample
144564-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
144564-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
144564-56-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
b9e9da9c88641fc5f17e003fb1126d7c
-
SHA1
cb6a31c1c72ee6f9c54f549f8e812a4d013881be
-
SHA256
98dd1fb795cc9d1efeb006469d2c7790d30346a9374e4310b1d094d359029aad
-
SHA512
d77b2ece7de6426002b686075f287f8252f0e9fc91c0db284fcf8f786baa2b1b1bd549ca4bad240725999580b696e4ba9d43e34d6352b35bd374cb097a4b5ab8
-
SSDEEP
1536:TmfG+zC1sW0XD6bYqY/bYGgfj0P86c4eF6ZiXblg1sKy+CbRQLbuMZ0d1WY0wuel:K9C1sW0XuUqYSl6G6UXblDPQmbWYhPt
Malware Config
Extracted
redline
62.204.41.141:24758
-
auth_value
7f9e6cf941b1bf2200810271959a3881
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
144564-56-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ