Behavioral task
behavioral1
Sample
1372-185-0x0000000000170000-0x00000000001A2000-memory.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1372-185-0x0000000000170000-0x00000000001A2000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
1372-185-0x0000000000170000-0x00000000001A2000-memory.dmp
-
Size
200KB
-
MD5
becd0f380e2a8f9a5c0d2222d612436f
-
SHA1
31c1140214e784a95712e8ca018a7d563a3af500
-
SHA256
2b599a9a500696288409dd338b40bf962da15135309c98a85721c158aa827429
-
SHA512
818487a99c78caefdf2d3d0c7bac732222fe2faae40dbc399c5edc01463381635094304b869def2179f612f9f8f42064403f96891906ab2a21058d036a0ac3a4
-
SSDEEP
3072:8xqZWFFa7E6T8UGen593h+wxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+caK:SqZcUt3h
Malware Config
Extracted
redline
cr10
176.113.115.17:4132
-
auth_value
0a52a09c70a98bb6612362e5eb8b1d02
Signatures
-
Redline family
Files
-
1372-185-0x0000000000170000-0x00000000001A2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ