Behavioral task
behavioral1
Sample
292-150-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
292-150-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
292-150-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
2978680fd40c532452a11c16ddf54a0f
-
SHA1
d46f7680595f5f4d47acd9c0e1bdca4f6153d5df
-
SHA256
3920a39f7220fbcc46bab9472c482cae9b01fe2c7df92465a8e00a6bd4b12195
-
SHA512
7e00d0f6fd4993395b3eeb61559a9dea0446e648703e6deb2f6c747a09ed39a62ced5386a4e68715788ac819698d6327847aeccd61d95a539f9c96a1cc92ff3d
-
SSDEEP
1536:o6zhq36sv0W7TzGrWNrH8/GpICOS6rxdAvQfL9JxNSSYQv3buoiGEviG8230GkR:omM6LOe+6rxaofZJxNa6QGmiG823
Malware Config
Extracted
redline
top
83.97.73.124:53
-
auth_value
053e5ccc53982413753b68419138b23a
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 292-150-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
292-150-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ