Behavioral task
behavioral1
Sample
3348-898-0x00000000045D0000-0x00000000045F8000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3348-898-0x00000000045D0000-0x00000000045F8000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3348-898-0x00000000045D0000-0x00000000045F8000-memory.dmp
-
Size
160KB
-
MD5
a551b025905cb0c841e595530ae78911
-
SHA1
29f29a333147f91a5739e45a86e71242c80f17f6
-
SHA256
9093581852604891b95b7593f232e4550970cf577ba50a569915fc494444aa01
-
SHA512
75e502dbda2e0b220d9e4e80da28410ea2e787c4a2288fbf272c4347be865abf4ad65f517a5a2829074a446d09de353383b0f44789a0899e3e972bc5ac4e672f
-
SSDEEP
3072:EYO/ZMTF3XuIQj/98KkQy9yvT/VGDFTyRXIhjSSfP:EYMZMB3XuIQyKkQy9y4cBIh
Malware Config
Extracted
redline
31.10
194.87.218.5:9630
-
auth_value
6223ceba7350b5fdfd29a51c01ad5fdb
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
3348-898-0x00000000045D0000-0x00000000045F8000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ