Behavioral task
behavioral1
Sample
1972-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1972-56-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1972-56-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
db5380892500789470a2e6503dbb85d7
-
SHA1
84eedbb70edc595266c25393fb02fed39f6dbe4a
-
SHA256
2ae4b11c5ddd44510246a254e90c6fe5cbfab29a58ceafb63d676fbc7aadc3af
-
SHA512
871f63b113e98d1cf7c143a265e0b32e79cb796e56235aaeaf511b1de5950db573cd55ce37a990b5f1c512414747af039dfe2d40b8138d8005b1841b01f04b7f
-
SSDEEP
3072:mYO/ZMTFL+pB1bRXC02WGy5TVVcDF1yRPuhpSSUE:mYMZMBL+pBLy02Wv5T0ipuh
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
145.239.202.9:4120
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1972-56-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ