Behavioral task
behavioral1
Sample
4212-149-0x00000000001D0000-0x0000000000200000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
4212-149-0x00000000001D0000-0x0000000000200000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
4212-149-0x00000000001D0000-0x0000000000200000-memory.dmp
-
Size
192KB
-
MD5
da405f72ebb638f866378f72276ac428
-
SHA1
b8dc9d56fa8317a6e1be912e3b2f30d163f9a837
-
SHA256
049a877bb83d268ac87dcd42530d1f06a7b6281ab7960c9db20e362d2cdac2c4
-
SHA512
f3847c2face64860d2840d191ff4a9f155ff94c7b1727b05ad53a8d70432ac8b0d7acd64f0d04e9aaf28878930e5ac476cbf428f444aa6c687a001a080d598df
-
SSDEEP
1536:WXzGzxuk36sv0W7TscooTrH6TuUa809jL1axN8oYQ/1buuatDaUFewS0GkRv8e8F:WXq8WHmiVrBaxNagg5aUFewS88e8hX
Malware Config
Extracted
redline
boris
83.97.73.129:19068
-
auth_value
205e4fccc0f8c7da1d56fb1da4ac5e6a
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 4212-149-0x00000000001D0000-0x0000000000200000-memory.dmp
Files
-
4212-149-0x00000000001D0000-0x0000000000200000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ