Behavioral task
behavioral1
Sample
2908-141-0x0000000000850000-0x00000000008DC000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2908-141-0x0000000000850000-0x00000000008DC000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2908-141-0x0000000000850000-0x00000000008DC000-memory.dmp
-
Size
560KB
-
MD5
ece84dd046acd10288a2991df90fc53d
-
SHA1
03d9a9cdcf4f98f60c8c28f3fb5692c513b1a42a
-
SHA256
4aa3e189e0e3994bbc603bb4680fee3c1eddd7c92cab9264931679b4d789e4c8
-
SHA512
cce8e4299fb69cf356e05bf78d88f90395041c06388187b8876f2b7ba69cc51df856a14c91bf329d72e2f287723dc456abe72b2e2ef316018cb639f2733352f7
-
SSDEEP
12288:V+EUqxavSLdZng89jRVTtAssly0gsQ9k4Qz0/lcXzU:VblaqrnBVTwly0LQtF
Malware Config
Extracted
redline
lamp
77.91.68.56:19071
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2908-141-0x0000000000850000-0x00000000008DC000-memory.dmp
Files
-
2908-141-0x0000000000850000-0x00000000008DC000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.A0g Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ywq Size: 358KB - Virtual size: 358KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ