Behavioral task
behavioral1
Sample
3108-159-0x0000000000D70000-0x0000000000D9C000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3108-159-0x0000000000D70000-0x0000000000D9C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3108-159-0x0000000000D70000-0x0000000000D9C000-memory.dmp
-
Size
176KB
-
MD5
77577290bf4788991b05b07713044691
-
SHA1
e0840cc9da7e5fd043ae198c14025b406ee24966
-
SHA256
c46bb3f67c80d7215717609bd2a0dae9cb336fea7346dace40c64f24da1f0c26
-
SHA512
b60ac16f592fe8e04706e4b9e2d7041b206f07d00c38aefc8d187550c233472b0290a6c9660f59575f955aa5a22db5d41218815ad5ffdb782ea6967f10d573f4
-
SSDEEP
3072:T4nVRMcuh7ZoB10Te+FQSzsLyJqoD2X9CIDl2pbzKu5zV/dM3K6hh:3hlJqoD8bR2pbzK0V/dr
Malware Config
Extracted
redline
0808-ab
144.202.95.227:80
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
3108-159-0x0000000000D70000-0x0000000000D9C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_ISOLATION
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ