Behavioral task
behavioral1
Sample
3088-155-0x00000000006E0000-0x0000000000710000-memory.exe
Resource
win7-20230712-en
General
-
Target
3088-155-0x00000000006E0000-0x0000000000710000-memory.dmp
-
Size
192KB
-
MD5
9534d5d8d54f74b4cfae67cd8a3cec23
-
SHA1
bca8ca10113edace5d9daeb6fd2744aba8b7a7ca
-
SHA256
f0f9d8199ff193cc279b7a9f90b9c9c470c80d57be4aa6cd16872fcabb78ba3e
-
SHA512
2d63f4e1490a92682c87ade4f2ddcdce296682d7b793810fa591574a464215648dafba65553451533cdbde38b44e0fda03a99b9ce9f4d22079201d9d317722b4
-
SSDEEP
3072:8wmwJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1Ju8e8h3:83zAmmI0k7vVe0E0YIM1Q
Malware Config
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3088-155-0x00000000006E0000-0x0000000000710000-memory.dmp
Files
-
3088-155-0x00000000006E0000-0x0000000000710000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ