Behavioral task
behavioral1
Sample
988-117-0x0000000002750000-0x0000000002790000-memory.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
988-117-0x0000000002750000-0x0000000002790000-memory.dll
Resource
win10v2004-20230220-en
General
-
Target
988-117-0x0000000002750000-0x0000000002790000-memory.dmp
-
Size
256KB
-
MD5
9736e549249108f1315dd1d856f74917
-
SHA1
511c212f8059f71e477a77cffdfe812e2cfd9502
-
SHA256
73f5f792ab32e6fe5bcdd411da074af1dac3f4a3ba719960b634b2432148f71b
-
SHA512
621cfdcda07406edf654976481ba35f0fdf4a3b50a2605f81238cece78190588688c34fd2fbab9350acb8349c01e06626ad09ffa5589eb58926d3261fc900579
-
SSDEEP
3072:y8e8hZQ6gJBO0y6RbAxNjgOqFra6lu8e8hZ:yde+oara6lu
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 988-117-0x0000000002750000-0x0000000002790000-memory.dmp
Files
-
988-117-0x0000000002750000-0x0000000002790000-memory.dmp.dll windows x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ