Behavioral task
behavioral1
Sample
2084-235-0x00000000009D0000-0x00000000009EE000-memory.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
2084-235-0x00000000009D0000-0x00000000009EE000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
2084-235-0x00000000009D0000-0x00000000009EE000-memory.dmp
-
Size
120KB
-
MD5
b262d92e83628c9956f023791f6d0f76
-
SHA1
fc16f92cbf8cb5a6ff0e7cc774727f9d2d586e87
-
SHA256
8597b8ca2ecc09d997f9339ab1ccd410c5f2bb453f5196a5ae1b1389e783cbc6
-
SHA512
3a2635c61685efae844c94d22af6ec1cf38e6fd2358f037cd338e92aaf5c1098af9493d8f12807fe4414dad995fa74df091970634cf721daadf3fa4ce7ee556f
-
SSDEEP
1536:/qswXqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2PHtmulgS6p7:degzWHY3+zi0ZbYe1g0ujyzdOQ7
Malware Config
Extracted
redline
pixelnew
194.49.94.11:80
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
SectopRAT payload 1 IoCs
resource yara_rule sample family_sectoprat -
Sectoprat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2084-235-0x00000000009D0000-0x00000000009EE000-memory.dmp
Files
-
2084-235-0x00000000009D0000-0x00000000009EE000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 93KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ