Behavioral task
behavioral1
Sample
840-92-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
840-92-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
840-92-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
28cab71f42e8aa2f28995c4de8d02e7b
-
SHA1
3ea1c0d7f585a3883494b2c5acef9822f5522aa8
-
SHA256
4cfeb2eb59a3edec9245d6531a0437fa5ec6c975c7f54cf936f5d9191f2dceee
-
SHA512
fa8f8f071e2c7bf1bf633b2f335c7f6dc6e469a6b3011d9fa1e1096089a4c532ccc22808f7a9630a9e6bf4bf1c025d310534ae716b31d41b0aff49ed7babd1df
-
SSDEEP
1536:evZi55zWapDfj7o9+bQCpPGVFqo7xL/DjCiLFa4vaJbu3zV2Y9+0wuei+xnYcA:exqZWsba4QwG79Lb/a4yexv9+hP
Malware Config
Extracted
redline
ads
34.125.68.133:80
34.141.168.40:80
-
auth_value
203c16f73cf3a5cf360de3db998e5e01
Signatures
-
Redline family
Files
-
840-92-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ