Behavioral task
behavioral1
Sample
2024-55-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
2024-55-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230621-en
General
-
Target
2024-55-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
c337dc1d1bad3ab8e0e08a5e830f6b12
-
SHA1
dde28ea6e97007878cf0d46b1a2277b4d7265a0a
-
SHA256
9d6322c398ebea4df90a2133410b08ee695fc5239856c6761932ee39d03f2f8d
-
SHA512
860eccea58c0150f57edd3ce507bea94df872f902aa1dcdf2e0b6f977b91fa425d19fc0c71aa71a4523bbf5ece8cf91abc75188460ece5146d10492d90f80878
-
SSDEEP
3072:A7TrQcSGCh9C4XrzqWNxNHUK6O9ec+s448e8hE:WTCzLXrzjFT9ec+s44
Malware Config
Extracted
redline
2red2
77.246.110.195:8599
-
auth_value
6afbed7ed4602cb49fec2738a899a241
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2024-55-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
2024-55-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ