Behavioral task
behavioral1
Sample
56240-61-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
56240-61-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
56240-61-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
27b5b2b0b8b8c35a6613c2c65d5c9abf
-
SHA1
1090b71f2f4077533ea3fd9f5a6aca0318be7cb4
-
SHA256
6c21cde67ed6c6a8845667977ae14fb098708ce0cfa3d5eb741545a1d7eb95fa
-
SHA512
4e5ee4bc7b7ee4e233f96c3ac0db2260a1cee49750447e4a9f4fbc6e0e0f69088a9554ae300f2f50a2966432830bd1d2e03819b0e14a19e630674565d0b02954
-
SSDEEP
3072:EcvFBwCYppi6ILQi97liuQ1QcTNNTChI4EASNT:Ecv+KJli1ecfChI4jS
Malware Config
Extracted
redline
@lolhpman
litrazalilibe.xyz:81
-
auth_value
3750d4bd3fbc0bc82038d5b906416358
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
56240-61-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 102KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ