redline | 2392-180-0x0000000000700000-0x000000000078C000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2392-180-0x0000000000700000-0x000000000078C000-memory.dmp
Size

560KB
MD5

6f067b356ba89546ced92062ae8924bd
SHA1

5c083c0c162dd0c6295fa35de278543df888779f
SHA256

5cfe6d8f2feaf937e9fd37136d587c1b6b5422f76bc3d4c10b37ee9bb7308fd7
SHA512

5dd1e54a63b710fdfdb98e7922bdc47884a675f3832559a98776baa226ed722c31cec52ee4564fd063b58bf9b27377c0c21fd7efb09745e99f5a6065d7ced357
SSDEEP

12288:xoZs4BTQ5THKRyidHZlXts7/rVUZ1DV3S2LIQVw7eIO:xoZFTQ5mhpu3GfDV3S6IO

Score

10^/10

lamp redline

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2392-180-0x0000000000700000-0x000000000078C000-memory.dmp

Files

2392-180-0x0000000000700000-0x000000000078C000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.zsr
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.6b&
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ