Behavioral task
behavioral1
Sample
1408-56-0x00000000047D0000-0x0000000004810000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1408-56-0x00000000047D0000-0x0000000004810000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
1408-56-0x00000000047D0000-0x0000000004810000-memory.dmp
-
Size
256KB
-
MD5
96e88b64c58b1d91bdc4a166d6addafa
-
SHA1
bdf23c47a8a3b7138a9c2c4a421eddc05780d831
-
SHA256
0986ffee23279b97fb4e593d50ce9a57882290c538f34c1a9a261bb19cb0211b
-
SHA512
3b9ef9e78813ab148359c35da22821965b75cb1ae5b310bc51d5a55cac7a4d41bdd2c4a9fd1c64f868c4590a3e85b07008c8cf8eb5194a2610b3d117ea19f15e
-
SSDEEP
3072:G8e8hQn9OZYFKqVkQJvLgl9Ow8e8hQew+xcv88WX7Yl:Gb9OpDggl9OwKwepU
Malware Config
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1408-56-0x00000000047D0000-0x0000000004810000-memory.dmp
Files
-
1408-56-0x00000000047D0000-0x0000000004810000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ