Behavioral task
behavioral1
Sample
972-137-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
972-137-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
972-137-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
dc7a4b9d54480bdc22769d6896284f43
-
SHA1
19d20f4bae280a47f295cb29c0b6a914e786c252
-
SHA256
80ebc88180780d0d4f4d6cdd1c42774c60637b59617f3a8278d111e442443c49
-
SHA512
aa83bca8ce2b56f20f08dbf20769576610e51a90e040c39848bf530b98cb4b98ace7e0bc6d7ef6ffd37fc5a69d3232ff013c46f4f82d48bb9df8337324b7d7b1
-
SSDEEP
3072:XxqZWjnacI0iLl58Zlre95F2h5HxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuO:hqZ7P8+2h
Malware Config
Extracted
redline
@rozebalpedistall
185.244.182.218:2027
-
auth_value
be1d24f4fbd185a6c652470a30ff75b2
Signatures
-
Redline family
Files
-
972-137-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ