redline | 4944-169-0x00000000008E0000-0x0000000000998000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

4944-169-0x00000000008E0000-0x0000000000998000-memory.dmp
Size

736KB
MD5

2672c1458cba5d8572565eb55af8b515
SHA1

21fa8897a3a4b46d0cb3424e8f59ed2d2b741b43
SHA256

91763f99e35fa32e4765c461935c402cee25319d63361672b428ce2045a48883
SHA512

bb49405566ebe9968dd89053c87cffe3d23341cb0e288fdce1a4ac62ff2945cd57b70f450225beabd1fc3d506739ab39f8f8e9a4c954b341acc2988fa38d063d
SSDEEP

12288:0j63vqEkp5lOSb2Bwcvdi7Aj6TEi7fQhSiEv0Y2/QvyuoqXaEaBKWYGMTJ5SUb+5:0j63vhkp5lOc2itEi7QMiEvhr4EoYGWe

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

4944-169-0x00000000008E0000-0x0000000000998000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 146KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ