Behavioral task
behavioral1
Sample
e220074db3744526376ffeaecbddb75fda9f082395555b4f9efe36a01e6aabb5.exe
Resource
win10v2004-20240412-en
General
-
Target
e220074db3744526376ffeaecbddb75fda9f082395555b4f9efe36a01e6aabb5
-
Size
305KB
-
MD5
ce13de75d22fd12f651f949c46d5a7d9
-
SHA1
0d5ea1328c7917c86d15ce4d2e05d51f8a4e7eb7
-
SHA256
e220074db3744526376ffeaecbddb75fda9f082395555b4f9efe36a01e6aabb5
-
SHA512
de5426b73c2b8a27b8fbf5e21ac8adf75c73d7e190573ba0ef7405736fb5d1a85cc020e3ac1dbc80e07ada8737608df138b587cade8d74eebda839dcb7694a1e
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Malware Config
Extracted
redline
spoo
103.113.70.99:2630
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource e220074db3744526376ffeaecbddb75fda9f082395555b4f9efe36a01e6aabb5
Files
-
e220074db3744526376ffeaecbddb75fda9f082395555b4f9efe36a01e6aabb5.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ