Behavioral task
behavioral1
Sample
2940-1-0x0000000001290000-0x0000000001664000-memory.exe
Resource
win7-20240215-en
General
-
Target
2940-1-0x0000000001290000-0x0000000001664000-memory.dmp
-
Size
3.8MB
-
MD5
86bd510e82ddbeeed224a014252df6ee
-
SHA1
dc08c1d1d044182a17bb8d04180eeb1cd829b716
-
SHA256
f3d5f618f805a55845a444e3a70f9117d3807ed1905251ca4f6abeba5e420888
-
SHA512
eee4dc6edad7a6b21d87d8de019783992dccf68169897c52ee507132625f414c25a9b6698ff7d29dc15cc040ec2337cd967ed41eb9205c72727b5a5ba8d35c53
-
SSDEEP
49152:oKi1ozDWxeE15o1SiTHIc55eaF4dHpqQ6BESt7WMbs9:oLUCeEI8UIqpF6p56BESAV9
Malware Config
Extracted
redline
1
77.221.156.45:18734
Signatures
-
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 2940-1-0x0000000001290000-0x0000000001664000-memory.dmp
Files
-
2940-1-0x0000000001290000-0x0000000001664000-memory.dmp.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 192KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 120KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 912KB - Virtual size: 912KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ