Behavioral task
behavioral1
Sample
2432-186-0x0000000000020000-0x000000000003E000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2432-186-0x0000000000020000-0x000000000003E000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2432-186-0x0000000000020000-0x000000000003E000-memory.dmp
-
Size
120KB
-
MD5
bbe3f2caf839fb756442f55ce3b2ccad
-
SHA1
5a5ed01e6b15dbae698896b69a50ecde28490188
-
SHA256
abe49bfdde570fa158d5d9dc4fffd610c8a71bdba14a0dea1f8b62c591ace0d7
-
SHA512
0b30b7d0671b3d1f8c7418831babb0885762662399f3d94dfb7c28eb9ee709a196630b3d231d011dc1605233aca53f83bdc9ba7b26a2b0a031108d0c367dfaba
-
SSDEEP
3072:x3HcjBPe7NerE+CrFkDSuOkZDcXiqEqVX6:xeGKDRAXb
Malware Config
Extracted
redline
6012068394_99
https://pastebin.com/raw/8baCJyMF
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2432-186-0x0000000000020000-0x000000000003E000-memory.dmp
Files
-
2432-186-0x0000000000020000-0x000000000003E000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ