Behavioral task
behavioral1
Sample
3856-186-0x0000000000870000-0x00000000008A2000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3856-186-0x0000000000870000-0x00000000008A2000-memory.exe
Resource
win10v2004-20220901-en
General
-
Target
3856-186-0x0000000000870000-0x00000000008A2000-memory.dmp
-
Size
200KB
-
MD5
b11dc3ba2c99148946df4177f9751a11
-
SHA1
4f8a23a4e16a0656b1dc264af4bb3477d0f16613
-
SHA256
cd1b9540be19e38dff3e989c0f7a118d8ae6e0aece31ca5bd7db43792709ed81
-
SHA512
3c26541295989d6c963c58607f70514c7d66803ed763834bd1c666f6d5b8d660309813274fc276320d9e5f5c32f3be573df016f87c37ad4b54562f4bcf210735
-
SSDEEP
3072:0xqZWTHaJIppU4LFca4devt9ThVTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOi:KqZH4LFcxUTh
Malware Config
Extracted
redline
temposs6678
82.115.223.9:15486
-
auth_value
af399e6a2fe66f67025541cf71c64313
Signatures
-
Redline family
Files
-
3856-186-0x0000000000870000-0x00000000008A2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ