Behavioral task
behavioral1
Sample
4780-142-0x0000000000550000-0x0000000000580000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4780-142-0x0000000000550000-0x0000000000580000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
4780-142-0x0000000000550000-0x0000000000580000-memory.dmp
-
Size
192KB
-
MD5
8c943d17b71f8767263ae1a305d6f0c6
-
SHA1
eaa1bd55cad24b6f7fb1a7565a9a6b39de3c1e71
-
SHA256
d23829d3b59bd813b5f0920cce0501f815c18d5783cb0fa3f3cd622cd961c8e5
-
SHA512
68826a39764205aee2a11269040bd38e5436e7d07608053daec7854b388db50078eafba9b617e3816ae55619ff03391294fdc1e7753d680fc93b079033f6996a
-
SSDEEP
3072:Nqa9m74qpXtmOnJjBawT253uaxfKfVvXgDOL3DvpPL0F0JCb3O3Cb3hzmzUEcC8w:JsfBanMh
Malware Config
Extracted
redline
82.115.223.46:57672
-
auth_value
7f99faa87181e4a6964f8f813d68f826
Signatures
-
Redline family
Files
-
4780-142-0x0000000000550000-0x0000000000580000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 103KB - Virtual size: 103KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ