Behavioral task
behavioral1
Sample
3488-178-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3488-178-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3488-178-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
6260f58b0ab516beea0454f13cbcad2c
-
SHA1
efdd5264980d0c003a374bd38e8317dc58f14f6c
-
SHA256
6cd591a77114050ed52ec6b99651d7f8cf3bde2c55b0ed307e2c6f8cbd40c317
-
SHA512
a008f7fa4822a0216030f9e4d3ea770dcacf3ca14cfbe42bda3e1fb430efbfd0afabe2f00fc386f6016c17ced4bff3f39aec8b217713ed04eecf4ababb032539
-
SSDEEP
3072:gxqZWjfa8oty3aF4IeJce359QhXrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOC:OqZCaF4ZJLQh
Malware Config
Extracted
redline
bundle
65.21.5.58:24911
-
auth_value
6ba39c71235c326fff2ec73530bea821
Signatures
-
Redline family
Files
-
3488-178-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ