Behavioral task
behavioral1
Sample
996-69-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
996-69-0x0000000000400000-0x0000000000460000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
996-69-0x0000000000400000-0x0000000000460000-memory.dmp
-
Size
384KB
-
MD5
3f327c4f5e3890fcf65a18b93cfe3883
-
SHA1
6252d23cb98fb044457606709306b1b735c18d4d
-
SHA256
b6012880098bfec076944f7fcce90f6e965b2f58512380c43bbdbffdeec5db96
-
SHA512
458878c6eae66c893c22081d1658605ceb13269c537bd7fb06fab78ea2c8ee18017197c7a585fb463e87fc93d8ea64231ecf17c22b4e2ff601eb2261f8d08746
-
SSDEEP
6144:ih6B8UfPZNhuazWunkhn35bq36fo/tk0yYC+924ano1LVnTiVPf0FDfT24RVHELc:EcBz1Qnc3dPCjno1LVnTiVPf0FDfT24f
Malware Config
Extracted
redline
0512
81.161.229.143:26910
-
auth_value
c020923553bd23ba826df75b6d76d4de
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
Files
-
996-69-0x0000000000400000-0x0000000000460000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 356KB - Virtual size: 356KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ