redline | 1420-93-0x0000000000360000-0x00000000003EC000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1420-93-0x0000000000360000-0x00000000003EC000-memory.dmp
Size

560KB
MD5

0a9849e712a04b804d58831e43755b35
SHA1

d325c098311cde3710ce7f2778acceb2dcb44237
SHA256

385769232e54c76ff2de56c2a8f6795368f56cd8ee1b411d5de90c42a3425a5a
SHA512

a17aa1aac4b11c5236226784f1f87f371482e08c772212151f91c94f6959fe253108b3d14b50242983f76d5abaf575b4def7a9dc8f207cbf653a1b211967f4ce
SSDEEP

12288:qzmDAPyVjqBSPS2vIdNisSfXKsinFg8Vvj2HDhQD1vPpc:qzmDBV+XdSfKsyO8Vvj2Opc

Score

10^/10

lamp redline

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes

auth_value
ee1df63bcdbe3de70f52810d94eaff7d

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1420-93-0x0000000000360000-0x00000000003EC000-memory.dmp

Files

1420-93-0x0000000000360000-0x00000000003EC000-memory.dmp
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rtm
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MHN
Size: 354KB - Virtual size: 354KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ