Behavioral task
behavioral1
Sample
1856-142-0x0000000000400000-0x0000000000446000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1856-142-0x0000000000400000-0x0000000000446000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1856-142-0x0000000000400000-0x0000000000446000-memory.dmp
-
Size
280KB
-
MD5
33b244ba24e99802632dd733e603de03
-
SHA1
8fd86fb28a9a5b3cfc4925938bb9e3fe71862340
-
SHA256
f948c75967e8f34dc436d7b85da9acec4c65dd50ad8634fc4a7067b19b535ef9
-
SHA512
11f9c6b501eaa0e5f3253ea2d4094714196bd1adcddea3a025369389dfc95f499296e1e441cb2bffb4cee83d9b47b75574edc3251f904bcb5243a503df288611
-
SSDEEP
3072:wxqZWD3aWNIUK3whvcu0wMej99chyaGol3wZ+Zr9Q7nQtPzEMxw8d1uKsgKn:eqZrwhvfHTchbGol3wZ+19Q7Q6x+0
Malware Config
Extracted
redline
10k
77.232.38.234:34068
-
auth_value
2cb0fc67f1f413ee2838b025c8663c6b
Signatures
-
Redline family
Files
-
1856-142-0x0000000000400000-0x0000000000446000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 148KB - Virtual size: 147KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ