Behavioral task
behavioral1
Sample
2140-139-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2140-139-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2140-139-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
d09f35d30da3e122bb4e6f307405df97
-
SHA1
5489619e4f1ec06c18bca556eb097041928f1653
-
SHA256
400243c453455f7336ecbaf9a9e52dcb7ff9a6dd74711b4c5be368f4eede1852
-
SHA512
d8b89d53fa68d80d72778bfd1c782147a21de5a2993d881720be7425d18e0c2dc14f99b09cbb6bc266d9e62ba93f6995f0ff7c491b315eb867b0bf8dd2fb3ec3
-
SSDEEP
3072:KpxqZWD3aWNIUK3CjmTaeCwFhh6vqo4m3OlAMhn2gxmjgDHde8rG9OHPXXzzz:KbqZrCja/hhw1nyJy+PXXzz
Malware Config
Extracted
redline
10k
109.107.191.169:34067
-
auth_value
2cb0fc67f1f413ee2838b025c8663c6b
Signatures
-
Redline family
Files
-
2140-139-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ