Behavioral task
behavioral1
Sample
1876-76-0x00000000012D0000-0x0000000001310000-memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1876-76-0x00000000012D0000-0x0000000001310000-memory.dll
Resource
win10v2004-20240226-en
General
-
Target
1876-76-0x00000000012D0000-0x0000000001310000-memory.dmp
-
Size
256KB
-
MD5
e7e082a91f36fc61c4ec2b13fecd806d
-
SHA1
7f89e8b0e02e09358abae99e4a42abd3f59a2f6d
-
SHA256
c21ffa5ee3fd846428f69c566274d28c1bee9553c9528563d0447bb3cbd4f6e4
-
SHA512
731a00d61d9e01b80107b9096ef67a54c9392de7dbd5752b61e413f91f7620e25dde90f6a8087f8ae543ec54739121ec640445ead96ab3be282875f13431e0de
-
SSDEEP
3072:Z8e8hKmfXEqVMVxI/C6gXm8e8hKHObYH2HaN:Z8f0bGC6gXmAYH0aN
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1876-76-0x00000000012D0000-0x0000000001310000-memory.dmp
Files
-
1876-76-0x00000000012D0000-0x0000000001310000-memory.dmp.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ