Behavioral task
behavioral1
Sample
1724-55-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1724-55-0x0000000000400000-0x0000000000432000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
1724-55-0x0000000000400000-0x0000000000432000-memory.dmp
-
Size
200KB
-
MD5
34f6555c8083eb89067762ec549c95f1
-
SHA1
ed7101bec1cdb49b2ea2399561938b5c36e24718
-
SHA256
b9125ec7a47b95c76ac84513381603c864055ed07dd3cddcd08856e764656940
-
SHA512
04e7424dc550b2d08865de3e726263371af4adfd491623ea598722410aa2c1f231a17244c685cb8aa329cd10e2cf9d09b413f6e9c51ce64f7d1af1dc6157efd5
-
SSDEEP
3072:GxqZWXragQx+/Q5Pc2Mw8egG97hzjxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jd:sqZWQ5PX/L7h
Malware Config
Extracted
redline
karas
45.15.156.21:26932
-
auth_value
35ad3cc0be03aa0ffb1329784c9907fa
Signatures
-
Redline family
Files
-
1724-55-0x0000000000400000-0x0000000000432000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ