Behavioral task
behavioral1
Sample
10361220x00000000002C0000.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
10361220x00000000002C0000.exe
Resource
win10v2004-20230703-en
General
-
Target
10361220x00000000002C0000.dmp
-
Size
192KB
-
MD5
f0e8acbad4582335fdad36c6c82890ad
-
SHA1
8a7019ef33a54ef966d63e71f927f80265d2f345
-
SHA256
8c41b6c8594a729343f245dc4687115eda4bd3b4dfae57d0d5de72963e877fd6
-
SHA512
6b8df3734f920938f098e64e29beaec1e165852ccbf59777960a3874fcc8576380e5de7167f6bca19debf62df7a4047a477280f317ac04061dd9b8790b2a5055
-
SSDEEP
3072:fEV5bSQxA6IldyYxN3KVaxLzzUY472H8e8h9:fEFAlW8TLzzUY472H
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10361220x00000000002C0000.dmp
Files
-
10361220x00000000002C0000.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ