Behavioral task
behavioral1
Sample
70520-190-0x0000000001120000-0x0000000001180000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
70520-190-0x0000000001120000-0x0000000001180000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
70520-190-0x0000000001120000-0x0000000001180000-memory.dmp
-
Size
384KB
-
MD5
d1890f5e7c397d688d529f7ee20d7caa
-
SHA1
0cd304e98b4058b5092c6645bebd34458d27b893
-
SHA256
7d55afaf513eac62660e203be84400395920709024c7c3af293098ccdb3caf20
-
SHA512
cc44f0df9b2c7580398aa44d5cac439b10efb2aa9f5bb6fb9bb0dff771f3cd7b41d493c77dd885354f6937b09b6a6e4d69299b851e90802a3848a4eb90c59a42
-
SSDEEP
6144:+dmub3lTEbu5pw2hl0aFypvtphfb9NV46zGfH1dS3eFTJVwVKmh8LFRxNyJJXBBN:uB7ah2hSEypvt71MoelJVwVKmh8LFRx8
Malware Config
Extracted
redline
mario23_10
167.235.252.160:10642
-
auth_value
eca57cfb5172f71dc45986763bb98942
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
70520-190-0x0000000001120000-0x0000000001180000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 355KB - Virtual size: 355KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ