Behavioral task
behavioral1
Sample
1100-645-0x0000000000320000-0x000000000035E000-memory.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
1100-645-0x0000000000320000-0x000000000035E000-memory.exe
Resource
win10v2004-20231025-en
General
-
Target
1100-645-0x0000000000320000-0x000000000035E000-memory.dmp
-
Size
248KB
-
MD5
3f4263cc3064781cd0eb294574730098
-
SHA1
b1df2347a78cfbea376ff40cbe517872d3d10c44
-
SHA256
27b4dceccfcce8e8b2bc9c8a83f51145098487ee31fcfb7fabe607d2e77662ab
-
SHA512
7f7b26795e013281e7dccdf5a1d228de8d386bdba59eaaa5661d76616f03b2843b58669ef2aa9e741018e3d52f3ede4280928fcc1fce62c2ed5f52dd7e294f27
-
SSDEEP
6144:GgrADDNgc6jYb9PXl3/f8FuAqSkiLWD+a+:BrEDNgc6jM2LO+a+
Malware Config
Extracted
redline
tests2
185.216.70.238:37515
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1100-645-0x0000000000320000-0x000000000035E000-memory.dmp
Files
-
1100-645-0x0000000000320000-0x000000000035E000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 177KB - Virtual size: 177KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ