Behavioral task
behavioral1
Sample
2436-104-0x00000000006A0000-0x00000000006F2000-memory.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2436-104-0x00000000006A0000-0x00000000006F2000-memory.exe
Resource
win10v2004-20240802-en
General
-
Target
2436-104-0x00000000006A0000-0x00000000006F2000-memory.dmp
-
Size
328KB
-
MD5
911d14a70fbf1e1d373487247f1cf138
-
SHA1
6b1572f11f13cc6c1e201999833a091eb462895b
-
SHA256
c6c0aea4d5d749b2fc5d8e76bcda93fd6fec896d183f80e56e59a28da21310bc
-
SHA512
6690e5b93359687bf9dcbd5118e90ea4783565e3bbbad6533703ba50c560cb798267c8daa9db9cf4d749fd366ebcf94a6d941dec6f24f1d29980fb622beb23ad
-
SSDEEP
3072:KcZqf7D34xp/0+mAOkyovcQQgIAB1fA0PuTVAtkxz53RceqiOL2bBOA:KcZqf7DIjnjXxB1fA0GTV8knkL
Malware Config
Extracted
redline
Diamotrix
176.111.174.140:1912
Signatures
-
RedLine payload 1 IoCs
resource yara_rule sample family_redline -
Redline family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2436-104-0x00000000006A0000-0x00000000006F2000-memory.dmp
Files
-
2436-104-0x00000000006A0000-0x00000000006F2000-memory.dmp.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ