Behavioral task
behavioral1
Sample
1032-56-0x0000000000400000-0x0000000000454000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1032-56-0x0000000000400000-0x0000000000454000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1032-56-0x0000000000400000-0x0000000000454000-memory.dmp
-
Size
336KB
-
MD5
7e795c9776b5e2205f918792a688e563
-
SHA1
e8bc0418a111fb193d940b80299d0317e547ce76
-
SHA256
80432c9faa73d56f4bd1bd898679b3850879fdc3fcf9d36db82e28a180c3b8f6
-
SHA512
2d3eef96e8d7037fb7c89b4b7d839fa111ce90c75d373695ab8dc4ed5782c4adb9fbf8eb24218adf43193d650acaa9c75213f00affdd17421a04427ca1bbeb44
-
SSDEEP
3072:4YO/ZMTFFZ++In7+hRKklbtMEmWFpQRXehESS4g6Ae/TX2:4YMZMBFZNIa95mtBehRgcrX
Malware Config
Extracted
redline
love
45.15.157.0:22789
-
auth_value
f2b8ce19d1b1584a3972de28dfe5bf40
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
1032-56-0x0000000000400000-0x0000000000454000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 177KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ