Behavioral task
behavioral1
Sample
17260-286-0x0000000000560000-0x0000000000588000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
17260-286-0x0000000000560000-0x0000000000588000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
17260-286-0x0000000000560000-0x0000000000588000-memory.dmp
-
Size
160KB
-
MD5
8151a8b114415df6a5f19250071c4e4f
-
SHA1
2af9fed08034a6974db88a93c8e4764dbd13c550
-
SHA256
20047a3c9c797c22c763feddf7249f8821171708d70dcb3f4e7ed3951506a122
-
SHA512
4c1d2fd36cca031fc6bdd27ef2c898bd99b5e0af4c103c833b95fe2aa7893c52e1901521a3746e97a22c30631c30f9d3ee8a205e01fe869b75bc2aa59510f070
-
SSDEEP
3072:bYO/ZMTFgcf0hnN4be5spjX+NVvDFTyFPqhJSS6b:bYMZMBgcf0T9shXIAVqh
Malware Config
Extracted
redline
Google2
167.235.71.14:20469
-
auth_value
fb274d9691235ba015830da570a13578
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
17260-286-0x0000000000560000-0x0000000000588000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ