redline | 2380-44-0x0000000000950000-0x00000000009D0000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2380-44-0x0000000000950000-0x00000000009D0000-memory.dmp
Size

512KB
MD5

4b49c56d41589495c89c31381aa765b4
SHA1

54e9a795bfa9e932dd8826532bb8f90ec8451229
SHA256

0a41233d155d332cad881ab76a0dd2f00f5b91dbfaa34deeef5c45b8c3c8d65f
SHA512

4d0a5e7d72b8e7fa083677259d4abfc8a3f2036714a6335ad2facdec8d609f83332171f83b5022afd9b374676e7817be616fdb8ac2b9aceca49e8d5fa5a13338
SSDEEP

12288:RfYxDR96dtVMzjSkfU2RCPgQ4RUbfD4cPVEDhQFhTd4:kQVJR

Score

10^/10

redline

Malware Config

Signatures

RedLine payload 1 IoCs

resource	yara_rule
sample	family_redline

Redline family
redline

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2380-44-0x0000000000950000-0x00000000009D0000-memory.dmp

Files

2380-44-0x0000000000950000-0x00000000009D0000-memory.dmp
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

_.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ