Behavioral task
behavioral1
Sample
2428-1134-0x0000000000790000-0x00000000007D0000-memory.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2428-1134-0x0000000000790000-0x00000000007D0000-memory.exe
Resource
win10v2004-20230915-en
General
-
Target
2428-1134-0x0000000000790000-0x00000000007D0000-memory.dmp
-
Size
256KB
-
MD5
e84901592e11cfe3beba4c5430dbe6de
-
SHA1
767a2d33b1b89788d2cba993ff6d0b1605ff4565
-
SHA256
2b5a954d26e8d96bd15e92f805023b071df11a3f3e8d17fab777686b831b6040
-
SHA512
b50dca03dabfa03478c0e47f95f4243868cf3a8e015ed55a49a231d75160cbb25ac7312e8a584aee5c428fd36854cd5a4c38cad8c5e80cf9d505d2b9e6520974
-
SSDEEP
6144:HskoGLNgcdoFskoGLNgcdoTFOV5ju57/QyP/rDk:NfLNgcdoPfLNgcdou07jDk
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2428-1134-0x0000000000790000-0x00000000007D0000-memory.dmp
Files
-
2428-1134-0x0000000000790000-0x00000000007D0000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ