Behavioral task
behavioral1
Sample
1712-56-0x0000000004820000-0x0000000004860000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1712-56-0x0000000004820000-0x0000000004860000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1712-56-0x0000000004820000-0x0000000004860000-memory.dmp
-
Size
256KB
-
MD5
0af77d106add302b9fbd66c9e693ea1f
-
SHA1
cedeff678695aad75a6c5403f20b3b9b472fdbfa
-
SHA256
eb838bc17dadccb5842f0912552c5fbdebff1be6f74aa804f0a1b68fc04180ff
-
SHA512
c98420eb2eb4e304f8f9641b91ffa0702c504c481ae49b803150650e3c6e989878fd2d9476c56a8675e57003e2508f69f9b33ca8a3210ef4d6b539195ddbe8f9
-
SSDEEP
3072:88e8hMWKC8oYLhFyaAPY7IVTGqV8se2QnVyKX8e8hMy:8OK+kQi7SGY4nVyKXa
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1712-56-0x0000000004820000-0x0000000004860000-memory.dmp
Files
-
1712-56-0x0000000004820000-0x0000000004860000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ