Behavioral task
behavioral1
Sample
2012-22-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2012-22-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2012-22-0x0000000000400000-0x000000000043E000-memory.dmp
-
Size
248KB
-
MD5
c7563efe4f4b0a504ab8b1af73855171
-
SHA1
193cda20c1ddc726fc509ab94750089cb6bd679b
-
SHA256
07f20d01178e6bda22362d02e5c6994f14cc41764981654151673b09f49d29d2
-
SHA512
d928a72bbd3ac36d35a9a56ca2772e67315ee3d71d75559c09cd8ebcc6e2910b6b2d0bfd945c16ee3ad77c0a6924c134fd86d028aa71a5e2f1ae1e21812f529c
-
SSDEEP
3072:5BBgjShnANgcMdYFsLVOlL+Mvt/qNt6wEIM9hmJYVvlnokt:SjkANgcMeFsLolL71/G6/IyhcYVvln
Malware Config
Extracted
redline
seevpalpadin-103
38.181.25.43:3325
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2012-22-0x0000000000400000-0x000000000043E000-memory.dmp
Files
-
2012-22-0x0000000000400000-0x000000000043E000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ