Behavioral task
behavioral1
Sample
4004-133-0x0000000000150000-0x0000000000182000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4004-133-0x0000000000150000-0x0000000000182000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
4004-133-0x0000000000150000-0x0000000000182000-memory.dmp
-
Size
200KB
-
MD5
c6ac17e69658565c72d53157450706b8
-
SHA1
7b164fc394845d8640c4bcc0fc4aab331ab443a9
-
SHA256
8ceff4e2b60810d1e520b568ad4916ea4bf585d8a61b87c69eb65e52f57cb0a0
-
SHA512
bf9d53f1dcd79724263c302bfad5376bf47d631803b7c48e6b324a8957b8b69bb2fecf00b68876f4d2aaaa9b9c4c313b4ee46a81da69b62775d6c73ec86b3f61
-
SSDEEP
3072:FxqZW2Ta9ApGvaKanFeD59ch4exNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw:PqZyaKw0ch
Malware Config
Extracted
redline
135.181.173.163:4324
-
auth_value
a909e2aaecf96137978fea4f86400b9b
Signatures
-
Redline family
Files
-
4004-133-0x0000000000150000-0x0000000000182000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ