Behavioral task
behavioral1
Sample
660-88-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
660-88-0x0000000000400000-0x0000000000420000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
660-88-0x0000000000400000-0x0000000000420000-memory.dmp
-
Size
128KB
-
MD5
686e48caeb4f2d6c2de4bfc3785f5378
-
SHA1
002b9e85a39e7afb516df8f7fce360b3c4fa1fbf
-
SHA256
5c8641ab6d869e51025936f0ae293842f9a9d3e007f300c9041e6a2f9238e47a
-
SHA512
800d7112809e4c1f05db2992d2ccaf2f3acb864aa0780db0b97ec6f77cf12782afb13d3e5b75d2d92dbe80e712d196dda24fb1a534fc4e6fdc55973bc384b733
-
SSDEEP
1536:k09akCrqG2aItAGcogbomxDL/u8j6MeYgbAEoa474yx6g:kACrqG2poFuS6MeXfdoV
Malware Config
Extracted
redline
91.243.59.21:20856
-
auth_value
c51b6b00ac38375fb2c44a2c9e5bc08b
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 660-88-0x0000000000400000-0x0000000000420000-memory.dmp
Files
-
660-88-0x0000000000400000-0x0000000000420000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ