Behavioral task
behavioral1
Sample
82800-87-0x0000000000090000-0x00000000000B0000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
82800-87-0x0000000000090000-0x00000000000B0000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
82800-87-0x0000000000090000-0x00000000000B0000-memory.dmp
-
Size
128KB
-
MD5
74bcc4fd815752f7f89c2e0ebb92e124
-
SHA1
aa45d80f88c1ea0ced7760054a74db649478845a
-
SHA256
c365697ebf55fde7c1b770c68175f8cb28815e7aeb031850ac6a954b3eea79f0
-
SHA512
7659a9f7fec5644329ec5dde0edc1a237b0c22d9d874ae0ac4e8af133dc857ad88e3323418f709b339318cfff4abfc20b3ca45d449e944b0e4d97b488499de09
-
SSDEEP
3072:dC1s00X1UiklDCnl6ZjT1sp8REu7WyhtB:gs04l68p86yh
Malware Config
Extracted
redline
185.215.113.83:60722
-
auth_value
6bb5192cbd9d4bb9619ed3f6f8e06498
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
82800-87-0x0000000000090000-0x00000000000B0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 101KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ