Behavioral task
behavioral1
Sample
98752-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
98752-56-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
98752-56-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
5904154d4504986a4c839b12411b87c6
-
SHA1
20966ac4e9c175c002461c2ba2b2477567a34aff
-
SHA256
b1d9aa68dab0b8997d53a98e8073d0c1dddd1176e3a7efd42e7ad686fe7f8815
-
SHA512
4c832a3206bfdbadcd4356fe1409a26f537001ff2d20c14fa24a71dd6920b3539cab4546d5ae3beb4aca7ba2cf05ff7d338eb0f57f59b96af177ddfb82e796c0
-
SSDEEP
1536:TqW+zC1sU0XDMbYikZDPy0gFj0B8ic4eF6ZiXblg1sKy+CbRQLbuMZ0d1W/0wuet:aC1sU0XIUikZcjiG6UXblDPQmbW/hPF
Malware Config
Extracted
redline
62.204.41.141:24758
-
auth_value
ea069d64c780fc5379eeb0792909ac77
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
98752-56-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ