Behavioral task
behavioral1
Sample
2216-0-0x0000000000230000-0x0000000000260000-memory.exe
Resource
win7-20230831-en
General
-
Target
2216-0-0x0000000000230000-0x0000000000260000-memory.dmp
-
Size
192KB
-
MD5
7abfc27fc20a366ee906081124922731
-
SHA1
eec51c518d1d90196f510ede7f56a106424516c3
-
SHA256
a73af0cd9f96ee1afb829d40f30463bd3fb2cc021dd5f74b348e972081e00d85
-
SHA512
443f99373f282041f1b0c9ad90846219a70ca2d52805253a839b0705370e4157b3067596edcd0dc56f472e7052efd8839073812b7674aa26a5eb1dd305cac9cf
-
SSDEEP
3072:tcSRfLY0HI0quMxZVOTpdzbyWZbSE0OzdagVhSSJo8e8h/:tzRLHI0quMxZiSE0ynVhSSi
Malware Config
Extracted
redline
1509
176.123.9.142:14845
-
auth_value
e8ab62d10d26859f42bdbe0489305426
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2216-0-0x0000000000230000-0x0000000000260000-memory.dmp
Files
-
2216-0-0x0000000000230000-0x0000000000260000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ