redline | 1372-55-0x0000000001E50000-0x0000000001E94000-memory[.]dmp | Triage

Sharing

General

Target

1372-55-0x0000000001E50000-0x0000000001E94000-memory.dmp
Size

272KB
MD5

e079fa0f7279184a08106087142a2962
SHA1

0fda733f7e2f31cb00de7d57a7cfbbd48f4d16f2
SHA256

994a61caf72c121c013548e995bf42b662468b5abebf9dcce17133e865d7083b
SHA512

a3f4e007eebe86bbcfc77797d045aad7a773ae707e0289cb97bd33a6c279412263e764973607c5253202bfb71243fc8b59e8d51990342ce3e0ae29c3b81c61f0
SSDEEP

3072:dH6j9ELD6ZhPCSxNbOkK7r2N/ey/B+DCIgyo40A7knhBynlqpzEPxNn2pU9f2MKD:dH6jXtGaeuM/0nhMnc

Score

10^/10

@2023@new redline

Malware Config

Extracted

Family

redline

Botnet

@2023@New

C2

91.215.85.155:32796

Attributes

auth_value
0be5b9b84cd5b707e91a48e341e3f7d7

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1372-55-0x0000000001E50000-0x0000000001E94000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ