Behavioral task
behavioral1
Sample
137572-146-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
137572-146-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
137572-146-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
c2314a33552d4a4353286133567083e9
-
SHA1
e95815f6503ab3f163adb330f279f818dd18d58a
-
SHA256
bfd0d8b632e4b64755cdce8d5bfff2525c2c4617eaa492f494cfb39c262cbd2c
-
SHA512
89f82c3cd3b6b1fc4d9f4df2df0cea73e98423a26be6f2aeeda6a6af22cb9f0815f0d724724b7f38e7f17b7f8b012227e25c7a4b3e9492ba2d879202f2ebe07a
-
SSDEEP
1536:BcGETCdXRendqAyR/lBlRqSVroo39iHxaRfAUO+xb8buc+VMP2iQL0wuei1Wb3d4:yGECuOjbVr51AF+J0FIbiQLh1yfP
Malware Config
Extracted
redline
79.137.192.47:46759
-
auth_value
67c54899f07d261b61aeef71b1ae3f6c
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
137572-146-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ