redline | 2008-55-0x0000000001F70000-0x0000000001FB4000-memory[.]dmp | Triage

Sharing

General

Target

2008-55-0x0000000001F70000-0x0000000001FB4000-memory.dmp
Size

272KB
MD5

5aa32eff0a0688ff6b57f57181bbeaf2
SHA1

4ddf0c1596c087adc122d4624f511ea8a54f2956
SHA256

6caee1286ad49c06712438b1cc81d16805e2c519a119684596362e23ba1dfd7b
SHA512

71283e41982413a31f7dd50f2ec4f4fe103de6012830842f78b09654cec3d41c7e4afe53873ecb67e5a1aa65c414e5bfe557b27b9ee2eb9eaf992efd8269b462
SSDEEP

3072:9q6jYEL5629hC2Fh6NBrGGGiDo40BCsyhIVniLMVxNn2pU9f2MKTV/wi4lr55R9l:9q6jtVh6NpGGGZyhiniL

Score

10^/10

post redline

Malware Config

Extracted

Family

redline

Botnet

Post

C2

138.124.180.186:39614

Attributes

auth_value
4bda2ce09764851c19dedd9d8ed8328e

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

2008-55-0x0000000001F70000-0x0000000001FB4000-memory.dmp
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ