Behavioral task
behavioral1
Sample
2128-133-0x00000000001A0000-0x00000000001C8000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2128-133-0x00000000001A0000-0x00000000001C8000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2128-133-0x00000000001A0000-0x00000000001C8000-memory.dmp
-
Size
160KB
-
MD5
e288dd1959571b098ae2dafda92207f0
-
SHA1
9878c79100577ae5a0c20730156b5a3b4207591f
-
SHA256
8b625e8d6ee716c09d86ebf0bbf265b0a98b529c2a247fc51876fe556f6470d6
-
SHA512
7f225346b9e864e9a140fe39c9c9933fba084b26f5a327ac25079836767816d22e6a85de86c67bf7e437ccb4a5921e0cc38e238e13d794f156ed0eb3461368c7
-
SSDEEP
3072:HYO/ZMTFtJjcZ7GFn/gQeJGV4HDFPyRXehsSSmz:HYMZMBtJjcUxoQqQBeh
Malware Config
Extracted
redline
1310
79.137.192.57:48771
-
auth_value
feb5f5c29913f32658637e553762a40e
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
2128-133-0x00000000001A0000-0x00000000001C8000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ