Behavioral task
behavioral1
Sample
1748-207-0x0000000000210000-0x0000000000242000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1748-207-0x0000000000210000-0x0000000000242000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1748-207-0x0000000000210000-0x0000000000242000-memory.dmp
-
Size
200KB
-
MD5
070defcdc7401f94aec505acc92146e3
-
SHA1
d066342884595e17c8702408b816b35d66b4df9a
-
SHA256
6e87fc8aa1846c8895aa936211cc69ebc0bca5f66fc1957c3a0e6b607b9c6fcf
-
SHA512
8229e798dea501070b3ad82458210328c81c9c672fe5cab747e55e27a49080bb75b067c03bbdcb3282cd52c7762f34070a07e0d6cb0a5378e88c92fe9376fd2f
-
SSDEEP
3072:SxqZWn7aNQYF8Hu1el5FRh4OxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cs:AqZuHu2Rh
Malware Config
Extracted
redline
crnn
176.113.115.17:4132
-
auth_value
6dfbf5eac3db7046d55dfd3f6608be3f
Signatures
-
Redline family
Files
-
1748-207-0x0000000000210000-0x0000000000242000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ