Behavioral task
behavioral1
Sample
1576-750-0x0000000000060000-0x000000000009E000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
1576-750-0x0000000000060000-0x000000000009E000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
1576-750-0x0000000000060000-0x000000000009E000-memory.dmp
-
Size
248KB
-
MD5
fe762b7670ca52c0c26643ace5e6f03c
-
SHA1
7f9a78359efca98703c8dbd82cdf56e99e4e65d0
-
SHA256
5a251ec910583cd1fd424de25628af363dc97c1256ef3368458c82fd4e408d74
-
SHA512
48892fdb51b8bd62cbf9a74d90123ef9c8462aac0497b3e05aa191a909b5583465d2e4aea1ce9a63e8ec4fb59a7e091fcbef828e23299e37b5105348507421c2
-
SSDEEP
3072:s2PLqOze7nDNgcYde+t9P/Kt/qbe9aKC9GYYOtLDt:s0Lm7DNgc8vtO/D9aKC9V5tL
Malware Config
Extracted
redline
clientfile
194.180.49.159:80
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1576-750-0x0000000000060000-0x000000000009E000-memory.dmp
Files
-
1576-750-0x0000000000060000-0x000000000009E000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ