redline | 944-124-0x00000000023F0000-0x0000000002434000-memory[.]dmp

General

Target
944-124-0x00000000023F0000-0x0000000002434000-memory.dmp
Size 272KB
Sample230301-xp378shc7w
SHA256 a73cfe3999c47728dad35edf85c8bde6a420923d599a1d0ca875a18542dac3b4
MD5 26857dff7515a7d791a6e6dd487c022c
SHA1 ad2ca49221ed0a3f19b1c9380ab8301d80a068e3
SHA512 f116e0316dd0e7d0fde1854778cbadfd01c8a054094bc3de11788a4711068be95afe7594d68c8b73a20e7397b92608b915106dd798d21772af21553e8cb27498
SSDEEP 3072:N6j4ELN6FY9C7zhf5hwVsmLoQYXJvLc99no40SEBShApnIlJJg6xNn2pU9f2MKT4:N6jidf5hwlLoJvLcPyShSnId
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rouch redline

Malware Config

Extracted

Family

redline

Botnet

rouch

C2

193.56.146.11:4162

Attributes

auth_value
1b1735bcfc122c708eae27ca352568de

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

File Explorer

944-124-0x00000000023F0000-0x0000000002434000-memory.dmp

.exe 272KB

944-124-0x00000000023F0000-0x0000000002434000-memory.dmp

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a73cfe3999c47728dad35edf85c8bde6a420923d599a1d0ca875a18542dac3b4
MD5 26857dff7515a7d791a6e6dd487c022c
SHA1 ad2ca49221ed0a3f19b1c9380ab8301d80a068e3
SHA512 f116e0316dd0e7d0fde1854778cbadfd01c8a054094bc3de11788a4711068be95afe7594d68c8b73a20e7397b92608b915106dd798d21772af21553e8cb27498
SSDEEP 3072:N6j4ELN6FY9C7zhf5hwVsmLoQYXJvLc99no40SEBShApnIlJJg6xNn2pU9f2MKT4:N6jidf5hwlLoJvLcPyShSnId
MD5 SHA1 SHA512 SSDEEP

windows x86

RedLine payload

Minor OS version

Major OS version

Entry point

190270

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing