Behavioral task
behavioral1
Sample
1012-10217-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1012-10217-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1012-10217-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
b3bacf71c4ee13b35dfe7826195dc904
-
SHA1
7893e0e8c927ead8e3d0aacadc1d56d6ed438788
-
SHA256
a6cef7be9e79540a5b9b410424877f257206897288eeab6aed2021e981527cc3
-
SHA512
4f395795bc290d37629f43c0e94eb5ddfa7eec6f818e532212f96487f00880124a3a89cd3961aa212845afff9007b095bb856bcaa97697d846d01b02ae61ec4b
-
SSDEEP
3072:6xqZWsTaQAYO7jLNNa4TeTx97h5HxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOC:oqZEjLNNxG7h
Malware Config
Extracted
redline
red1
34.141.168.40:80
34.125.68.133:80
-
auth_value
70f607e482f39051bebe438c28d43e46
Signatures
-
Redline family
Files
-
1012-10217-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ