Behavioral task
behavioral1
Sample
2040-183-0x0000000000430000-0x0000000000462000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2040-183-0x0000000000430000-0x0000000000462000-memory.exe
Resource
win10v2004-20221111-en
General
-
Target
2040-183-0x0000000000430000-0x0000000000462000-memory.dmp
-
Size
200KB
-
MD5
775c55c3a6d4938e330011c576a7476a
-
SHA1
458c5b4623d4b6feb1c7fa3852faa6cd8e67a456
-
SHA256
e52db6f5ae52036790222de432e09ce748abe27d286147439d2de17dadc661c4
-
SHA512
64d3ae20609513b2e9959f75460cf60aa746b5ba896596de38e8cfa422014c37c01782342473e85a66226817a57cf64ef2195055fb5ad0296e9442356c024eb5
-
SSDEEP
3072:TxqZWVNaDUSkPMKandeV59lhhv4xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuU:lqZ8MKwClh9
Malware Config
Extracted
redline
ck
176.113.115.17:4132
-
auth_value
7ac4424f89748eae7f5c6a4756d89c28
Signatures
-
Redline family
Files
-
2040-183-0x0000000000430000-0x0000000000462000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ