Behavioral task
behavioral1
Sample
2428-124-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2428-124-0x0000000000400000-0x0000000000444000-memory.exe
Resource
win10v2004-20240226-en
General
-
Target
2428-124-0x0000000000400000-0x0000000000444000-memory.dmp
-
Size
272KB
-
MD5
213dae92642e5fa1fd1025df83421bd5
-
SHA1
4b397fa5689ece0df91e1b0899144e9aa956a9a3
-
SHA256
deeaf37dc5a58a6ee0dc5def758b09417a6af1e2c116736e5637e916ecf403e2
-
SHA512
0fad71a81eebdb4a3846852499c1c8f24fc4dfad288935d6abdcd82d028e4aa49a5e7c1688f9ab158774b21974e45eec3f4164f4f0b709742c8cfbf5311359b1
-
SSDEEP
3072:VUQ5ww+AeU3M4PzTDWhYTpxOABwerqCnNsZWSZ5GxN8yi8yIHVF+q8e8hOo:VUQ5DSU84PDuSdti5ZkvVF+qC
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2428-124-0x0000000000400000-0x0000000000444000-memory.dmp
Files
-
2428-124-0x0000000000400000-0x0000000000444000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 175KB - Virtual size: 177KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE