Behavioral task
behavioral1
Sample
1856-0-0x00000000001D0000-0x0000000000247000-memory.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1856-0-0x00000000001D0000-0x0000000000247000-memory.exe
Resource
win10v2004-20240412-en
General
-
Target
1856-0-0x00000000001D0000-0x0000000000247000-memory.dmp
-
Size
476KB
-
MD5
4e03a8b47fd79073780247a6e4cf9cc0
-
SHA1
bd650429e9caf3bccab328cfa266ddbdc31d61ac
-
SHA256
997296883b8002efbc419c48dace260958941a9a661ee7ff3597110955f67b44
-
SHA512
5fed20315808a0342dd97ca45e9719a15613988693822076a03ccc12006f4f0c39f6b291606b77b5660d11c5eea05504e40b85e1dcdf541c3868cbfa43d9d968
-
SSDEEP
6144:b9xBK31F1T0rgPqY6imwPfkxLy6TA508scZqf7DIfLQuEp:xxBKFhP6wPOyr08scUzsfIp
Malware Config
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1856-0-0x00000000001D0000-0x0000000000247000-memory.dmp
Files
-
1856-0-0x00000000001D0000-0x0000000000247000-memory.dmp.exe windows:6 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 106KB - Virtual size: 106KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 309KB - Virtual size: 312KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ