Behavioral task
behavioral1
Sample
1636-152-0x0000000004930000-0x0000000004976000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1636-152-0x0000000004930000-0x0000000004976000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1636-152-0x0000000004930000-0x0000000004976000-memory.dmp
-
Size
280KB
-
MD5
42e6021d9bb5820d769cae73ccd02d1b
-
SHA1
992bb7573261358a9de91e90d61a59106a499fac
-
SHA256
7898819a0b3518af0e3277be5700cb423921c4404b244ac60f201b52340d9378
-
SHA512
5a5c6ef162d747730d2e85fbbdde3b1da085d91b0a503c1eaf55f4c9ab22533aa30c909df2f3a0f7ad14f029aea85d4e247f398d066ce0b878f1186da5265382
-
SSDEEP
3072:9a6jYELp6VFxCCWosai9QFwNsmLo0gacrilo40OTkQhOEnISw+dvoxNn2pU9f2MG:I6j+GosvqFwtLo0yr3QhZnI
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
Files
-
1636-152-0x0000000004930000-0x0000000004976000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 251KB - Virtual size: 251KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ