redline | 1048-57-0x0000000001290000-0x00000000012D0000-memory[.]dmp | Triage

Sharing

General

Target

1048-57-0x0000000001290000-0x00000000012D0000-memory.dmp
Size

256KB
MD5

2f2f858279fed95e3c38ef59bbbd83b4
SHA1

0cd55f26f630ad0ec243a8df948c39b4a17b8667
SHA256

98ac11aac0012b44ef79adc483d75ec7d54f5de3f56f186ec9cecd8d0aa757b5
SHA512

37fe6e7f50c6ca48bac19de062aad0e144cab7e2e232d444fd196ce753267adcdf6d84c9998596a318ed25de24e188e91393bdf2b2c673da52cc6f8aec1decee
SSDEEP

6144:Rz+Zpcirbu6fG9V1YMZMBL+WBLdIDppJhub6xyPz+:Rz+ZpcYGMOpJkbt+

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1048-57-0x0000000001290000-0x00000000012D0000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 141KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ