Behavioral task
behavioral1
Sample
d77aff3f5ebb9a7740858888391fa89d53613d689c9a3b102512e1ab968913d5.exe
Resource
win10v2004-20240412-en
General
-
Target
d77aff3f5ebb9a7740858888391fa89d53613d689c9a3b102512e1ab968913d5
-
Size
306KB
-
MD5
a2f66d8c290ab870e4dc694ec732e743
-
SHA1
cb0b9a54e2b2065f83ba5aa0bfb5882d5d3ede39
-
SHA256
d77aff3f5ebb9a7740858888391fa89d53613d689c9a3b102512e1ab968913d5
-
SHA512
5bf606d2ee9ad223e0503b17a0ebae89638a7fe0ba2647f7524657c9f512dfd6f0a0f3b2c563cf61c2520ff34cd6f04a9001b69a4a5ff4a0abf3f640b8be79a4
-
SSDEEP
6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/
Malware Config
Extracted
redline
spoo
103.113.70.99:2630
Signatures
-
RedLine payload 1 IoCs
Processes:
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource d77aff3f5ebb9a7740858888391fa89d53613d689c9a3b102512e1ab968913d5
Files
-
d77aff3f5ebb9a7740858888391fa89d53613d689c9a3b102512e1ab968913d5.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ