Behavioral task
behavioral1
Sample
2716-35-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2716-35-0x0000000000400000-0x0000000000430000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2716-35-0x0000000000400000-0x0000000000430000-memory.dmp
-
Size
192KB
-
MD5
eeda0761faa5e4107fc9f035870242fb
-
SHA1
7c5a107b75fca49135f6e78550c7db90d18be844
-
SHA256
ccd5ac045b5d1e77c468823df0804f30ddb5525da71b39f8cbb453a6c6b49f1b
-
SHA512
8da58a49df6443a273e75fd75934c4f9c10863d64c47be8bb53652a5b9b84d65724d04d73e58956c44625ad0c471607ff37b979f642f4d6a460e7a641e50accd
-
SSDEEP
3072:ofcuNvJTI0Af/37OGC/fhqGbE0gY10UxL5XpKWoUJ:OcGTI0Af/31GbE0R95XpKWoU
Malware Config
Extracted
redline
ALENA
77.232.38.234:80
-
auth_value
27c44831d5e2431d6b3f2750a6a0efde
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2716-35-0x0000000000400000-0x0000000000430000-memory.dmp
Files
-
2716-35-0x0000000000400000-0x0000000000430000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ