Behavioral task
behavioral1
Sample
1668-3076-0x00000000000D0000-0x0000000000102000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1668-3076-0x00000000000D0000-0x0000000000102000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1668-3076-0x00000000000D0000-0x0000000000102000-memory.dmp
-
Size
200KB
-
MD5
8f2f0d13a4f054851a4ead87cbce76f0
-
SHA1
c169dac04a8090ee4f4c7f9e7869d8b9aef7e6cd
-
SHA256
01c9f5e2a2f485113d1a696e74beaf935d2fc9e2e2cae7ee43df0e857eec3c2b
-
SHA512
40b8253633ca07185b391facc00147273a6deb470ad75dff383fe4f36c6663a7b4ed136cda4e2e4341d662a99e454a408ce4e91f7d82c04c9fa489b5d2b2d55d
-
SSDEEP
3072:/xqZW11a2kX8f516fTKev/FThwSxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuz:pqZk516LTTh
Malware Config
Extracted
redline
dogma
193.233.20.32:4125
-
auth_value
1b692976ca991040f2e8890409c35142
Signatures
-
Redline family
Files
-
1668-3076-0x00000000000D0000-0x0000000000102000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ