Behavioral task
behavioral1
Sample
2244-7-0x0000000004620000-0x0000000004660000-memory.exe
Resource
win7-20230831-en
General
-
Target
2244-7-0x0000000004620000-0x0000000004660000-memory.dmp
-
Size
256KB
-
MD5
7d5be04e36e57f30d09b4382741c713b
-
SHA1
b70476c33fb205a30e1eec5a9df244f72ad87e22
-
SHA256
30ed2d9c109c0a1653f24a23f132febfe4285b726bffae92e2cb880cbc460b21
-
SHA512
d071b248bfa19c317df317819f0c703a3a44627000605bf72b35df0e5b17a8023bef79fc8b33acc8871db8554f2cd66139e71e15f67a0c987ce0b10b3a470248
-
SSDEEP
3072:rkygEz24UyFI06YmlHOvbmWVheJE0AWMZq/iJk8e8hz:rkQztFI06YmlEMJE0Dv/iK
Malware Config
Extracted
redline
Dodik
62.84.98.14:8599
-
auth_value
377b3e8fd841293c888daf3412230c21
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2244-7-0x0000000004620000-0x0000000004660000-memory.dmp
Files
-
2244-7-0x0000000004620000-0x0000000004660000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ