Behavioral task
behavioral1
Sample
1092-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1092-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1092-56-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
3f8d070cb2a785fce8d3812ebe7a0b90
-
SHA1
273aef3b698de5465fd4d3a931ac9c68adcf2bb4
-
SHA256
7b47b82d05877f914fccae0477751e6104674e322ab3af9d6b4979f4808faaeb
-
SHA512
6e57624d202e25771ff0134c929ab9aecdf2b8c7debc3bf70dbd5801e657771722620ca3e2c5d1db28583eb05a24a21b4c13311263c5b969e6ca2b2ce85d5d68
-
SSDEEP
1536:+xGETCdpRendEAqO/zzpP96A6pxzEcv2rfAUO7+4lbuc+ZMPjJ4v0wuei1Pb3d3S:CGEoucsepyAF7/1FywJ4vhQuF
Malware Config
Extracted
redline
193.106.191.160:8673
-
auth_value
b452e7074eb79e37fc942576d3e3c701
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1092-56-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ