Behavioral task
behavioral1
Sample
42361240x00000000005500000x000000000074C000memorydmp_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
42361240x00000000005500000x000000000074C000memorydmp_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
42361240x00000000005500000x000000000074C000memorydmp_JC.exe
-
Size
2.0MB
-
MD5
1a9c0fba3bf200f7e21312218564bac0
-
SHA1
d496ebabd8f98535420ece93b9b3fd0b2827b9a9
-
SHA256
1a23773418dfd40bb94426a46cfd5dc51e0698081815ed654a49b656b6172c73
-
SHA512
f871881b0338ca9b95a7c6306a340438e5d144004e7c9938787812c76016c8036a27c6aa2f14c8bd503b86f4b1ebe0d2541afe926aa6a0a1e1fcd78ee72a926e
-
SSDEEP
24576:P2Ggoax3Sy1m5x1Gkh/R73e9uxNa79Lg1Ngc+bbo:P2GgCy1m5x9ROuXYRb
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42361240x00000000005500000x000000000074C000memorydmp_JC.exe
Files
-
42361240x00000000005500000x000000000074C000memorydmp_JC.exe.exe windows:6 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.textbss Size: - Virtual size: 297KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 679KB - Virtual size: 679KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 109KB - Virtual size: 109KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.REMO Size: 269KB - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.lmao Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lmao Size: 293KB - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE