redline | lem2[.]exe | Triage

Sharing

General

Target

lem2.exe
Size

355KB
MD5

6c1c75b8e3f80bfdf738d23fb9f8a190
SHA1

8ec4cfcf959a157af6c296a12d7ec865c4ff4908
SHA256

8c797eb6be050516d990bcf592f1ff3a20a9b0407ff4e4566e856f18dfbfb3b6
SHA512

7f74c91fa96f43b1c90aecd0eb7f205e1fb391a2d8144624a9d6aceac62347f03bfd7867d89f4b1007f09c0386ffa2b01c44436c1e8ef0fb2739c2bead73269b
SSDEEP

6144:PNcBtSvvtROQ1YHY+Ak0Q6PhmQqoDzqsDAm/4j3HaT:PNcB4vloQ1YHL9yqoDusVCKT

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
lem2.exe

Files

lem2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ