Behavioral task
behavioral1
Sample
3124-171-0x0000000000370000-0x00000000003A6000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3124-171-0x0000000000370000-0x00000000003A6000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3124-171-0x0000000000370000-0x00000000003A6000-memory.dmp
-
Size
216KB
-
MD5
1b8c7e539624c74cf93607e1e1841578
-
SHA1
9b1af83f8710e2f6c62d53f481202527a646c8c1
-
SHA256
5bf759f3f7e1a63d9fbaab6ae9448b16b48596f75b29a93f2d302132e024fedc
-
SHA512
9c926f14d0903c6d519aded5c47e70aece7cd8717c169be1e08a8cb1f0708af9a2742cc7d0914c3adefd251584722cd1337a8da8cfff97ec5496ec4f007a488d
-
SSDEEP
1536:2YRfKNZHRersizuk1KYzO8qOe91dbXEergyhN5pzurytkadOUw1y/pbYY3Gy:ZsHFCKYzdqtX0YVVBkkrhpPGy
Malware Config
Extracted
redline
installs1
89.23.96.2:7253
-
auth_value
fb538922d8f77f00fb6c39f8066af176
Signatures
-
Redline family
Files
-
3124-171-0x0000000000370000-0x00000000003A6000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 110KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ