Behavioral task
behavioral1
Sample
1976-63-0x0000000003440000-0x0000000003460000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1976-63-0x0000000003440000-0x0000000003460000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
1976-63-0x0000000003440000-0x0000000003460000-memory.dmp
-
Size
128KB
-
MD5
3197d2995976e7616257b0c73f0f075e
-
SHA1
b2954db678459d2b4bffcece3fc0f532ebc3ee74
-
SHA256
df5a313f860bb8c769c73b9c0d7da87efa7b9e4f216a1e2a7d5a76a80bdcb276
-
SHA512
5676c85cff6969e707776fb07a145cf87f6860ef19378567aacf8dedcde396b0e34b96714199589494964081c98f2d312464b036ee515cee30aa23579e3fae0b
-
SSDEEP
1536:qr/d2mXIu17JL98pVWjhNdmpHXlofMUR/Rd9KVgbZvN53m75gBju+FY:+/d2U17r86zd2lofMUR/v9Swd3g7
Malware Config
Extracted
redline
26_6
kitchenandfardenusa.com:80
-
auth_value
c6b02a7bd3416966e68d1032131c1488
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1976-63-0x0000000003440000-0x0000000003460000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ