Behavioral task
behavioral1
Sample
2240-0-0x0000000000230000-0x0000000000252000-memory.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2240-0-0x0000000000230000-0x0000000000252000-memory.exe
Resource
win10v2004-20231215-en
General
-
Target
2240-0-0x0000000000230000-0x0000000000252000-memory.dmp
-
Size
136KB
-
MD5
415a7ad59339daed7c7e740b949cc02f
-
SHA1
a739f894cfdee2d1df4a1cf98bf3f1854a2844db
-
SHA256
21559574436411dd7f650e10b494d4461b0911d3bf5c77a4f5479ed849693ce3
-
SHA512
54c934d663f3a820487b7f922177b20f8f7f51bcd495b346f6b5b8800fb453dc807fcd232e8b10c86f8bac2fcaea5af47ea4710721aa19b83370d18211e14101
-
SSDEEP
1536:+A4bzr5JPAmS4lZyNRxCuCk+G2Q4c3P9pdKU5GNby+xXmflMups6S:+vL++G2QDhFKyoWiH6S
Malware Config
Extracted
redline
978378968
https://pastebin.com/raw/NgsUAPya
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2240-0-0x0000000000230000-0x0000000000252000-memory.dmp
Files
-
2240-0-0x0000000000230000-0x0000000000252000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ