Behavioral task
behavioral1
Sample
2044-54-0x0000000000230000-0x0000000000260000-memory.exe
Resource
win7-20230220-en
General
-
Target
2044-54-0x0000000000230000-0x0000000000260000-memory.dmp
-
Size
192KB
-
MD5
fad51c86908906b34a93104e2bf3c451
-
SHA1
380973890baa123bdf02c226b0ef5af46721a5c3
-
SHA256
8d12a9be77e33546685691599b870e2a528ac166ab3fa0f9253702d7541073df
-
SHA512
2079ee864cc3763ce87911c5aa976a4e6f36c2b26bb35c7f420f12651ab9ab6d216e22de3e1d04ad6f3fda03e980afa46afcabd95000bacde1b804c79de1a90a
-
SSDEEP
1536:7buR0C10WqlVZRGWyuHrTog/XzMXMQ8ys88888888888888888888888g888888i:2R0feoog/ZpyqVEUCidWT8Fo8e8hQ
Malware Config
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2044-54-0x0000000000230000-0x0000000000260000-memory.dmp
Files
-
2044-54-0x0000000000230000-0x0000000000260000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ