Behavioral task
behavioral1
Sample
460-68-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
460-68-0x0000000000400000-0x0000000000428000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
460-68-0x0000000000400000-0x0000000000428000-memory.dmp
-
Size
160KB
-
MD5
a4100d670644ea795e13b14937c4b231
-
SHA1
a5a5f5b853b6dbd7d670604dbe93324fa42da0c0
-
SHA256
e11e39dc54ca8785d0bc951b863c49ef99ec3c9c2b70253e4dc4b11f541146aa
-
SHA512
c34885332d80b26679324738a948f1eaf480b0def84e6b8a1eaae45ac7d815777edcbb9dff63043973bfebed9ca67902da04a16d6fe1387ce3988b68fd2e50ee
-
SSDEEP
1536:M4GETCdfRendCASk/NrlpcUurt73SCnmfAUOKDGnbuc+OAPji4B0wuei1Wb3d3c4:hGEquG4UzUrAFKqbFZUi4Bh164
Malware Config
Extracted
redline
45.138.74.121:80
-
auth_value
0f54752d306900714b1167457cb8bb3b
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
460-68-0x0000000000400000-0x0000000000428000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 130KB - Virtual size: 129KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ