Behavioral task
behavioral1
Sample
2784-97-0x0000000000250000-0x0000000000280000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2784-97-0x0000000000250000-0x0000000000280000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2784-97-0x0000000000250000-0x0000000000280000-memory.dmp
-
Size
192KB
-
MD5
1df6d40b6ee751905ccaddb2ee034e67
-
SHA1
08c9ef2b8006496a0b3673487e9f7f547fe3e5cd
-
SHA256
9e6c28f518a00a7953765240c2ee0121e8091e520b898422bc1c45a083763a7a
-
SHA512
66baf220d178bf562ac54e48f8b711e73746757f4a09a6a93aaa0bbd969a3f5bc947fcb6a2a14076222553ccc5d4fcfbc305c5a4985d8964a797d9c6677e2d4a
-
SSDEEP
3072:dN9zgaHeuGhriktrBxN3kuZ+zdzm8e8hj:T9Ie4rhTodzm
Malware Config
Extracted
redline
furod
77.91.68.70:19073
-
auth_value
d2386245fe11799b28b4521492a5879d
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2784-97-0x0000000000250000-0x0000000000280000-memory.dmp
Files
-
2784-97-0x0000000000250000-0x0000000000280000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ