Behavioral task
behavioral1
Sample
2836-45-0x00000000000D0000-0x0000000000122000-memory.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2836-45-0x00000000000D0000-0x0000000000122000-memory.exe
Resource
win10v2004-20240419-en
General
-
Target
2836-45-0x00000000000D0000-0x0000000000122000-memory.dmp
-
Size
328KB
-
MD5
448768aefbcbe0cd1f13125279568065
-
SHA1
cdac2ab7645e7147ee84a589462a9e8f62769612
-
SHA256
82aa606282d9acdc897eb6a80b50326a90e1a3abcef87e441f4b34e73bec1028
-
SHA512
cdba3b40c86e9af8febb75b2b20bf195cad53df6abeaaa4270dc621c97eb8cb02f7f4d350c06c261c8e1a6bea83a1331963f21e7d2835820b92a97b87860fdf3
-
SSDEEP
3072:Bq6EgY6igrUjXwwRwPfsGZdkfD13TPCtASKNAcZqf7D349eqiOLibBOL:gqY6i7wPvZ2fR3TP+AvAcZqf7DIHL
Malware Config
Extracted
redline
new
91.92.249.182:34419
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2836-45-0x00000000000D0000-0x0000000000122000-memory.dmp
Files
-
2836-45-0x00000000000D0000-0x0000000000122000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 187KB - Virtual size: 186KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 115KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ