Behavioral task
behavioral1
Sample
940-56-0x0000000000080000-0x00000000000B2000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
940-56-0x0000000000080000-0x00000000000B2000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
940-56-0x0000000000080000-0x00000000000B2000-memory.dmp
-
Size
200KB
-
MD5
b29fc5f142737de8b370bf5372b949eb
-
SHA1
42b7331bc49dc2272784a9fb866e885f585276d0
-
SHA256
01f93f33651447c1cf6ff05a71cada21e3154918f7f09d86dd1fefb60b43740d
-
SHA512
4f34f0f984179a638604630c1404ebb14b5c69de031fe135fb233f135deba04a8c66005dfbd78e6fda8317b5d2f412e91617c330109e6b22e646839083031e86
-
SSDEEP
3072:YxqZWjfa8oty3aF4IeJce359QhXjxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOC:GqZCaF4ZJLQh
Malware Config
Extracted
redline
bundle
65.21.5.58:24911
-
auth_value
6ba39c71235c326fff2ec73530bea821
Signatures
-
Redline family
Files
-
940-56-0x0000000000080000-0x00000000000B2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ