Behavioral task
behavioral1
Sample
2024-55-0x0000000002130000-0x0000000002174000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2024-55-0x0000000002130000-0x0000000002174000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
2024-55-0x0000000002130000-0x0000000002174000-memory.dmp
-
Size
272KB
-
MD5
410e28e5c4117f162874c61a6625c54d
-
SHA1
0e04777a9472bcf29d871019c9d22fbdf68a06fc
-
SHA256
aad8102ee72db56760ee5ad8b92066ed5ff9e913f1e9fb4e3bf9cb5951b996b5
-
SHA512
cf1f90cf698b515f76ec3fff91a1fa8a74abe28e0e126b70c34e92ff1f2c262b766912bc588666423977a55d99ea1b91a9ca30bac4fe7ceba07217e264addd25
-
SSDEEP
3072:36jQELX61Q8LCRetiDiDIQJ/ek9ZMi6o40VNnE2hMLnqXMxNn2pU9f2MKTV/wi4s:36jYQ7yy8I4eqZMi3hUn
Malware Config
Extracted
redline
1C
198.244.249.186:21458
-
auth_value
43d665a8a4c34b128f37125fd19d766e
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
2024-55-0x0000000002130000-0x0000000002174000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 180KB - Virtual size: 179KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ