Behavioral task
behavioral1
Sample
1528-57-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1528-57-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1528-57-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
ac0a32569c73266fa592d1a89e7586cf
-
SHA1
6cbde9349df6ad22ec79c427b1e7f8789348f8ba
-
SHA256
9d511650967a747e426eed9ee1e6a4f8eb22f1681cbcf93818313147de2d69be
-
SHA512
5bb52a8e80e7482a00283d021c342ef12fa5925f3b27ea660f52c77d23abd8687c19668a44f5a6e58cbfdb4d1345f4521392598d6b944890e57b0901311ea07d
-
SSDEEP
3072:ZYO/ZMTFOj+SAIQv+Uc7uTFnRAB2AWFMHRXZIhRSSzK:ZYMZMBOj1Ag3D2A5BZIh
Malware Config
Extracted
redline
4
45.15.156.60:39908
-
auth_value
a78337a1d79bd33fe0a4c7afee93a6d0
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
1528-57-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ