Behavioral task
behavioral1
Sample
24536-230-0x0000000000400000-0x0000000000475000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
24536-230-0x0000000000400000-0x0000000000475000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
24536-230-0x0000000000400000-0x0000000000475000-memory.dmp
-
Size
468KB
-
MD5
6c97384bf1c43f6a604c43ec03adb12b
-
SHA1
15943a839014fa9ac25cdf3b452fe1a39ab49e02
-
SHA256
ce1df67ac3e908f3e246a5d0cd5e225f3439109c414983cf679a3a72cb9b52e8
-
SHA512
13a41f666903abdd6750215ca28e1eefc546bf0e6bcb687cb12ff517172eef1d1c2ae9861e14911468811fdd88e76aa09da8bb3de064c8c77ab48c0b351e5bbd
-
SSDEEP
3072:nYO/ZMTFLj164j7QluE1oW4ZV3DFiTRPnhiSSpOWbRFoc+oNWlX761NZ8KsV/+j0:nYMZMBLjc4IcEGWGEpnh/uIwPxsV/z
Malware Config
Extracted
redline
Mast1000
78.153.144.3:2510
-
auth_value
8e868b09fa3921a313a9a4fa08602f0a
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
24536-230-0x0000000000400000-0x0000000000475000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ