Behavioral task
behavioral1
Sample
1944-59-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1944-59-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1944-59-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
e5bc0fdf31e03d029b72f9421249ac2b
-
SHA1
3db86137fe3b3f2d3a45d964d283b1974e32d235
-
SHA256
19fb90d13504476e8f9a4e1caec2299d29df06ca901c2d0f7820e5a4e2375de4
-
SHA512
17d5df7ccdc466506eadd61e3d182d177240e55a9281776abd46be2472703edf457ecf7e4022daf3332eb9f026c4d4904d6ee99f8b099d15e051bb544570926f
-
SSDEEP
3072:PYO/ZMTFw/4Y7DcNjaUFyYIVCFDFJyRPAhFSS:PYMZMBw/4YkpaUFyYdFupAh
Malware Config
Extracted
redline
usa
45.15.156.46:31361
-
auth_value
7b4e12629cc7617503a18fea91b79708
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1944-59-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ