Behavioral task
behavioral1
Sample
444-103-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
444-103-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
444-103-0x0000000000400000-0x000000000043E000-memory.dmp
-
Size
248KB
-
MD5
463ce8c457450524b001f7cdbd97415d
-
SHA1
d5ec3298cead80cbde6ecb20d5e1af6b56fad720
-
SHA256
498f366edbb2358d1af121a6ba9b06f6fa5fa742c223010cd1d8d051758890b8
-
SHA512
f434d721903916d98931cb8c012788c0bc13bf370dd7835fdb6de8074460aa258237fd118daceb999f94f132112fe06615bb7645c4f68f662c6c73243437b3f7
-
SSDEEP
3072:OVXnPpnCniNgcpzE22NX2eSYht/qRuZ5EhBzEUlED6L:2XPpCiNgcpI9NXPj/hZ5E/oUlED
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
51.255.152.132:36011
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 444-103-0x0000000000400000-0x000000000043E000-memory.dmp
Files
-
444-103-0x0000000000400000-0x000000000043E000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ