redline | 1584-55-0x0000000000400000-0x0000000000428000-memory[.]dmp | Triage

Sharing

General

Target

1584-55-0x0000000000400000-0x0000000000428000-memory.dmp
Size

160KB
MD5

208991444da54f51c3e8c8fe2a1cc4ee
SHA1

ba5d8c915d056b12cf27139fd743409e78ec71b1
SHA256

34ebade5347641f67ac1bed24b5a775430239c6367649dd2de8683499c639676
SHA512

5114e85a967c07343d653e27bb085c4b7bcda75cba94048c0ddeda99beeec446a2feb3c2f9c1cc8753d17f64940ecafc5f844a109845cef2029db947c84dc5b5
SSDEEP

3072:3YEauDpbWLEiXj0YAFwhzFjwWQLhCOfE:3YE9WAiXw2A3Lhb

Score

10^/10

@patrickbat3men redline

Malware Config

Extracted

Family

redline

Botnet

@PatrickBat3men

C2

185.215.113.69:15544

Attributes

auth_value
d863b06c2a0af571a3a24c11a2a15b07

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Files

1584-55-0x0000000000400000-0x0000000000428000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ