Behavioral task
behavioral1
Sample
1100-12-0x0000000000400000-0x0000000000452000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1100-12-0x0000000000400000-0x0000000000452000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
1100-12-0x0000000000400000-0x0000000000452000-memory.dmp
-
Size
328KB
-
MD5
a1f12ff0fcef27c10a141c1f79325ba7
-
SHA1
09ea9e09ba51c2e4a41ed7cc01d22fbd6858a545
-
SHA256
12f85381d6f30bca0057c968c41eec90f91f3832cb6ff771bbba26b0990d024c
-
SHA512
71fb4f3a96a07bf7a8c84164dc83f1e85cc38c47c24a182d64cb8316df922d927c3432c5fb55b8e56ab3962ee1620a7444516e9cfa376709515fa46709a60a3b
-
SSDEEP
3072:icZqf7D34Tp/0+mAckyQE1Q0glNvB1fA0PuTVAtkxz13R0eqiOL2bBOA:icZqf7DItnmyTB1fA0GTV8kb8L
Malware Config
Extracted
redline
success
45.137.22.121:45785
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1100-12-0x0000000000400000-0x0000000000452000-memory.dmp
Files
-
1100-12-0x0000000000400000-0x0000000000452000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ