Behavioral task
behavioral1
Sample
1660-210-0x00000000000B0000-0x00000000000E2000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1660-210-0x00000000000B0000-0x00000000000E2000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1660-210-0x00000000000B0000-0x00000000000E2000-memory.dmp
-
Size
200KB
-
MD5
c1bb346fb4ae1681702911649759231d
-
SHA1
59ab3aff89c6fd3bd45fbddbb5f24d05c7222ff0
-
SHA256
3afd58d2c14335faf9eb631f91608a2744b38d82884e88575a8c35dae2d4839c
-
SHA512
c2ef688cb4d323327cad01110e157e0bd81c028d1cb52f4fbc6af66cbf010ed39cd260782b3522f7f7d58752a7f72791339940c459b38d7d15b34b49fb035b52
-
SSDEEP
3072:OxqZWfragQx+/1yEWGljSerhFOhXvIxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0J:0qZu1yEWY5Oh/
Malware Config
Extracted
redline
cr2
176.113.115.17:4132
-
auth_value
4bf573d6f5ab16f3b5e36da6855dc128
Signatures
-
Redline family
Files
-
1660-210-0x00000000000B0000-0x00000000000E2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ