Behavioral task
behavioral1
Sample
1768-56-0x00000000021D0000-0x0000000002210000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1768-56-0x00000000021D0000-0x0000000002210000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1768-56-0x00000000021D0000-0x0000000002210000-memory.dmp
-
Size
256KB
-
MD5
bc8cece45e0869786f51b27094af9f8f
-
SHA1
77e341ab3291a7bb633181395039cf1450ec06e5
-
SHA256
51497483db00a75647cddb058ae04fe095d422e0aa31aa4885b2214a50d2a16c
-
SHA512
daafed8ac380133dc6ce79882694cbaf507da01e3f68b5bce47daf3b53826f35f39b3967590ce34dc435b2e3ca951df4f6c553b726f75a6414e54e05b97d2086
-
SSDEEP
3072:W8e8hE7mhO3DqVetsD6Bv8e8hE5uD3WmBuy:WL5nBvJuD3Ay
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1768-56-0x00000000021D0000-0x0000000002210000-memory.dmp
Files
-
1768-56-0x00000000021D0000-0x0000000002210000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ