Behavioral task
behavioral1
Sample
680-56-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
680-56-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
680-56-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
222feb92ad7ae75699a9faa2e5f71d7e
-
SHA1
a3c90190924712056ee7f5de9f5043a2ad0bb93d
-
SHA256
17465a88554dd5cc31fd1245fb5dba7bc92535daed61d6749ed918fa4b06890e
-
SHA512
565c8afeeb88ef7b3aa1dc5cf51c716b395b985906c38693fb615cb0bcf281f756ece1bb780d344d7a2e6064532f99751309d6a027a0dd544c5377608bed175d
-
SSDEEP
3072:2xqZWN1a7AUEzhc2uW7SIeweBXF4h50xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw3:cqZ2hjuVRT4h
Malware Config
Extracted
redline
95.217.14.200:34072
-
auth_value
1bfac947c350008abe813772b735f0fc
Signatures
-
Redline family
Files
-
680-56-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ