Behavioral task
behavioral1
Sample
1060-3684-0x0000000004490000-0x00000000044C6000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1060-3684-0x0000000004490000-0x00000000044C6000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
1060-3684-0x0000000004490000-0x00000000044C6000-memory.dmp
-
Size
216KB
-
MD5
38ac51698d7f01698b61f41c6533bb72
-
SHA1
97139dc5bf9f073e99ab6aaaacd3e3b00bf5f7d4
-
SHA256
4bf986a404c4f38a690af3a2ae00b0d29e8e3508358ba98fa4457d4338cb0e35
-
SHA512
19b07c6b697d5876fec01734b95ebf6565066df9adc616e8f4d9a73d87536416c62c04b6392267783f50ed15dc91172ab071d1ddb5e38ebd2e9dde663730ec4c
-
SSDEEP
1536:uYF1qd1WeQreHKltSBWqauPectpbXEe3gyO9pzurQtsadOUw1y/pbYY3GN:n4WC+SBWedf0oV27skrhpPGN
Malware Config
Extracted
redline
installs
89.23.96.2:7253
-
auth_value
8d4428f372143572364f044ea9649d7f
Signatures
-
Redline family
Files
-
1060-3684-0x0000000004490000-0x00000000044C6000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ