Behavioral task
behavioral1
Sample
1116-116-0x0000000000090000-0x00000000000C2000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1116-116-0x0000000000090000-0x00000000000C2000-memory.exe
Resource
win10v2004-20230221-en
General
-
Target
1116-116-0x0000000000090000-0x00000000000C2000-memory.dmp
-
Size
200KB
-
MD5
010157fa289599b50ba3d5b17c390598
-
SHA1
3f5b894d7f5c33ec25e80cafa469e064a42bc758
-
SHA256
4495453f9b94b35d208d2fecbf8665bc115249509398e8ae63161c04a48ad445
-
SHA512
58dbc2d33264f9378121d523f76171b9f1c6191cefa7bdd2a8bce40e4e70e2a2096017932db07b9e72ff8719e774bba6adf0a54a46256d65c350ac1a907c7865
-
SSDEEP
3072:HxqZW43aWNIUK394+4jeKk9MhVvGxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jO/:RqZY94F+Mhx
Malware Config
Extracted
redline
7
89.22.237.107:44745
-
auth_value
9fb4a4a8b5764119b91a5d9c6a94b401
Signatures
-
Redline family
Files
-
1116-116-0x0000000000090000-0x00000000000C2000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ