Behavioral task
behavioral1
Sample
3376-135-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3376-135-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3376-135-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
232d185863c7c76f864867b67d66e49a
-
SHA1
62e8979b297ba5c09cc9d9c0d33e646aa4c3841b
-
SHA256
441cd93592f4ca3a0b99099f4262143dbf4a588b5cdb9ecb34fc37d3eb1b045d
-
SHA512
1f6a4359b30ef184be5baa0d79d2fd79bfa4ab08f3f9cecdf20b2fc25e2c3f27e5365e781070e490affbe82d1f0189c6668eee6473cb64368916d862243b5797
-
SSDEEP
3072:7YO/ZMTFzr+sIjLHyukVztAsbWFjy5XbhRSSwl:7YMZMBzr3I/g1bx5bh
Malware Config
Extracted
redline
Install
manddarinn.art:81
-
auth_value
f9affed97251c08e7a096257ba9edfb2
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
3376-135-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ