Behavioral task
behavioral1
Sample
700-56-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
700-56-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
700-56-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
7ed9e59f3d4c6390172c727df45b7025
-
SHA1
a30eb39ee0b32145b9646012f0c114d456b66b57
-
SHA256
db4bf2baf0fadcf0d20c74aaf369017cbd01d72e020b733e01e7955c6ba4eba0
-
SHA512
38c35ed6a01c4c3f712cfb6e558542fce3f634418de4e4091de970d5af8b6d50f4793e0096d87f465b1beebae3202ff1e71bcdff2a65dcd4be46b6adebfd103b
-
SSDEEP
3072:hxqZW11a2kX8fDLFcI4PeT992hdrxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jO6:TqZkDLFcre2h
Malware Config
Extracted
redline
pub1
89.22.231.25:45245
-
auth_value
9c5c8480222ae57e3bcdac11c63a526d
Signatures
-
Redline family
Files
-
700-56-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ