Behavioral task
behavioral1
Sample
2356-54-0x00000000002B0000-0x00000000002CE000-memory.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
2356-54-0x00000000002B0000-0x00000000002CE000-memory.exe
Resource
win10v2004-20230703-en
General
-
Target
2356-54-0x00000000002B0000-0x00000000002CE000-memory.dmp
-
Size
120KB
-
MD5
1af9797f590c72fc70088517e069b185
-
SHA1
724a3dfe5ca50da7961693a1015bfc2954055263
-
SHA256
8dda2efc25a06a14c76573026c7042c2de0cce894e23b323db0586cc4dbe90c3
-
SHA512
650df0a122596b1470b604cba32e933725c513b35e73fa5b4896d51fc559142bb08a86c2314dabb898a91cf5d263c43c148c6dd73380be3fd5edc852975ee8eb
-
SSDEEP
1536:2ATp9NZjE6oljj9tAtzZM4YCrB/atqgdbibEB/l2kBoSG7:2ATp9DOjj9tA5C4JJatvqEhfA
Malware Config
Extracted
redline
5328933591_99
https://pastebin.com/raw/tnW31tPp
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2356-54-0x00000000002B0000-0x00000000002CE000-memory.dmp
Files
-
2356-54-0x00000000002B0000-0x00000000002CE000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ