Behavioral task
behavioral1
Sample
1504-123-0x0000000000290000-0x00000000002C0000-memory.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
1504-123-0x0000000000290000-0x00000000002C0000-memory.exe
Resource
win10v2004-20230621-en
General
-
Target
1504-123-0x0000000000290000-0x00000000002C0000-memory.dmp
-
Size
192KB
-
MD5
6847a1af5fdf88aa98e4d95add27162a
-
SHA1
4fd5d303c366bee3fa75187ed010ef8787cd3ea0
-
SHA256
2651f2f2d2e24905d16ade3137debf892f1f133d3e498e48e387cd1c1d434396
-
SHA512
4e2339b39a02dc0c2fce3534dc4d6c29d4f7fb84886284c10920f8537209ecfc85afe8fddad9fb0cfbf83470a4ce7cd01caf6c9999faacd28a68191ce61cdacc
-
SSDEEP
3072:pnOrlpyS3xp5xN1yJ/4BMzxUdE/j8e8h+:pOf7flBMzxUdE/j
Malware Config
Extracted
redline
narko
83.97.73.134:19071
-
auth_value
a9d8c6db81c7e486f5832bc2ee48cb84
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1504-123-0x0000000000290000-0x00000000002C0000-memory.dmp
Files
-
1504-123-0x0000000000290000-0x00000000002C0000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ