Behavioral task
behavioral1
Sample
54125040x00000000001500000x000000000018E000memorydmp_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
54125040x00000000001500000x000000000018E000memorydmp_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
54125040x00000000001500000x000000000018E000memorydmp_JC.exe
-
Size
248KB
-
MD5
cb30dcd531a0c5550912e1a6c65c05bc
-
SHA1
38634c8be1f501080b8878d2d9eaedbefc18ba52
-
SHA256
42ac9c66b85b7176e40e73e55980ccfcf1a495a87c2b769d876cc54839613a9c
-
SHA512
bec1f532d3cc61b55c59cb7b5a79a2ba77f475370747f2757e349df920ca47f5b7ec8ddf1f579e73c7267b968c64bbdd8d6e88983821aa2557ceab0e863846c0
-
SSDEEP
3072:wJctOPGO2n1NgcU6YW8qu7SHBFt/qLdVPMxX/jEIgcR7:GDPGv1NgcUVWCuHF/CXPMxXLEfc
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 54125040x00000000001500000x000000000018E000memorydmp_JC.exe
Files
-
54125040x00000000001500000x000000000018E000memorydmp_JC.exe.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ