Behavioral task
behavioral1
Sample
2776-2-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
2776-2-0x0000000000400000-0x000000000043C000-memory.exe
Resource
win10v2004-20231025-en
General
-
Target
2776-2-0x0000000000400000-0x000000000043C000-memory.dmp
-
Size
240KB
-
MD5
02e5c9122e218b0f3ac81d4c38b50921
-
SHA1
86529c55c8fb392536ff58922cd49f7edcfad77d
-
SHA256
27d6e2d5f50e5b4cdc78adbc8bed2fe8d4521cebeff13ccb3a46a7f0ac7b5ce3
-
SHA512
5445bd1374e82ffcd3eafc839b78c7f000d2454e7285845ba33b2827ba408edb2010a1ee5c8c29f73334d16feb13ee15c56f48e7cedcfb3cf6409d3b7082ad9d
-
SSDEEP
6144:rrzkuv7SNgcD8rPEsCxG90EY1SGSI11AK:rPsNgcD8r/CSI11AK
Malware Config
Extracted
redline
LogsDiller Cloud (Telegram: @logsdillabot)
194.49.94.181:40264
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2776-2-0x0000000000400000-0x000000000043C000-memory.dmp
Files
-
2776-2-0x0000000000400000-0x000000000043C000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 176KB - Virtual size: 175KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ