redline | 1652-259-0x00000000003A0000-0x00000000003F6000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1652-259-0x00000000003A0000-0x00000000003F6000-memory.dmp
Size

344KB
MD5

4aa3e15d8a4399754e504197dfdcb4d3
SHA1

0d50d55fd34c39a9a4acf2da7fe0ab6a509deee0
SHA256

1dcbd8ea16f554a8958d7f4e1ad7b66259ee78e9758ef8efcb5a0224477c13b5
SHA512

5af73aeedf3d7ac405e9e2176011a79f114b669f3df21650022bfc429f3e8747cbba1aa2ad4f1d33940b088b0ebe9be708def360a6ad3fd1f0493b5e59964b7d
SSDEEP

6144:XtCsp1OQOmyTAe/fom50JusYAOGYMZMBgcf0T9shXIAVqhfbfI:X8sp1OQOmy8eIYgYGMj/Vq1bw

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1652-259-0x00000000003A0000-0x00000000003F6000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 143KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ