Behavioral task
behavioral1
Sample
1380-56-0x0000000002450000-0x0000000002490000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1380-56-0x0000000002450000-0x0000000002490000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1380-56-0x0000000002450000-0x0000000002490000-memory.dmp
-
Size
256KB
-
MD5
301c1fc4d12f00975eec1da2166a6dac
-
SHA1
9551ff201b9d44e47cc832086e5fcb65b1a517c0
-
SHA256
1dcf1d7ab9fd1bd08573eab1f1d5e742c4da44c8d64063a335ce08608ebd6420
-
SHA512
4a5590ad9d5eead301badb6256bb579e9e6396a9f8ec558bf6e58441721c9dbd72ab3ddeb6b93018ca4279906024c18b571de57530df8c890681950461e8d1b9
-
SSDEEP
3072:/8e8h3McD4TUsgc/61tqVwTqzXpTEq8e8h3:/JcD4osgpLoXpTEq
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1380-56-0x0000000002450000-0x0000000002490000-memory.dmp
Files
-
1380-56-0x0000000002450000-0x0000000002490000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ