Behavioral task
behavioral1
Sample
1088-124-0x0000000004CC0000-0x0000000004D00000-memory.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1088-124-0x0000000004CC0000-0x0000000004D00000-memory.dll
Resource
win10v2004-20240226-en
General
-
Target
1088-124-0x0000000004CC0000-0x0000000004D00000-memory.dmp
-
Size
256KB
-
MD5
6cf77c9f8597ebbc826652664b477dd0
-
SHA1
54aa41f67dc0238826dad4b30626d31463e85521
-
SHA256
a60877d9a41eb3564f0171b372cf04bddf9138765a9962cf125001430988e4df
-
SHA512
50c08397ed3fa7698201d394688c8d1b343678ff564fdc2935f58ff8c669cfc63097260b9ec6bc772ce47152c9bb5f8cd676b83252e94ec17e7481fbed2af7ed
-
SSDEEP
3072:h8e8hgClaTvI2t2qVwoMTOIkvlX8e8hg0kmfv4r8W2B:hGlp/RfkvlXcfvhB
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1088-124-0x0000000004CC0000-0x0000000004D00000-memory.dmp
Files
-
1088-124-0x0000000004CC0000-0x0000000004D00000-memory.dmp.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ