Behavioral task
behavioral1
Sample
3832-214-0x0000000000790000-0x00000000007C0000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3832-214-0x0000000000790000-0x00000000007C0000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
3832-214-0x0000000000790000-0x00000000007C0000-memory.dmp
-
Size
192KB
-
MD5
af3e7e1c9dbe4761fdb4111fc7eb320d
-
SHA1
5c3d62445e0998944fa51a0ad5229dba4e0185ff
-
SHA256
e0dba27779a7b9ba163868ebc84d7ff7bec1538438e27cdd451db34630862d16
-
SHA512
ae8bfe294aa0b0b8f57e9c015112a7969760f20595369f3ce90d049c8b75c2fbb04a335c923c7605d1b4d6f3b6e786b4ff23d6f79e4389c7ec32cb5c984f631a
-
SSDEEP
3072:9ORGSnRfr3I0SbF/tOOc5XjVEHyYoqE0sAiJrFueJ/8e8he:lSp3I0SbF/OVESYoqE0XmFue1
Malware Config
Extracted
redline
YT LOGS CLOUD
176.123.4.46:33783
-
auth_value
f423cd8452a39820862c1ea501db4ccf
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 3832-214-0x0000000000790000-0x00000000007C0000-memory.dmp
Files
-
3832-214-0x0000000000790000-0x00000000007C0000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ