Behavioral task
behavioral1
Sample
4356-38-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
4356-38-0x0000000000400000-0x000000000043E000-memory.exe
Resource
win10v2004-20231023-en
General
-
Target
4356-38-0x0000000000400000-0x000000000043E000-memory.dmp
-
Size
248KB
-
MD5
f130c1d9ed6c540d1e03e2b5a1061ece
-
SHA1
9179a3a45c01c3a5eb023c15b48bacb9c7eadfd0
-
SHA256
5f4c02cafd5542410d38213ae1293b636df85408dc2bcd4e3a5d6f1b916711ae
-
SHA512
72cbe75ef27d33089a0b6296859fe71153a248d132bd7da20afd2dbbb6c6bbd28d3ac77b8cca3c53dfdc29d8f15bd0d013311df9cca1a56232b7163477e6195b
-
SSDEEP
3072:1afto4niNgcr08sO6vvwQRfQPXCZ7eYtaHpKt/q1JlhHv5XGM83/+w4:MftTiNgcIXHnaBYt40/qlhHBWM83/+
Malware Config
Extracted
redline
supera
77.91.124.82:19071
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4356-38-0x0000000000400000-0x000000000043E000-memory.dmp
Files
-
4356-38-0x0000000000400000-0x000000000043E000-memory.dmp.exe windows:4 windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 178KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ