Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2022, 10:47

General

  • Target

    cb85b9c48dd70fce58140e30bd9618b9c68ba39bb5e3065365c2f062e9c87446.exe

  • Size

    362KB

  • MD5

    b4ffc50e485e347a264a6965da22b545

  • SHA1

    869abff1c3bbb714f9911ce7de0ec2244d9c35ce

  • SHA256

    cb85b9c48dd70fce58140e30bd9618b9c68ba39bb5e3065365c2f062e9c87446

  • SHA512

    9f50f170e354bd394e9be89053641a1ab536e424ccacbab3b6df097056e34538c039437b43975d87aeeb2f3a91e73c9fb61da4e631477930a59313f406ee8c76

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb85b9c48dd70fce58140e30bd9618b9c68ba39bb5e3065365c2f062e9c87446.exe
    "C:\Users\Admin\AppData\Local\Temp\cb85b9c48dd70fce58140e30bd9618b9c68ba39bb5e3065365c2f062e9c87446.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1056-132-0x0000000000990000-0x00000000009F0000-memory.dmp

    Filesize

    384KB

  • memory/1056-133-0x000000000B0D0000-0x000000000B6E8000-memory.dmp

    Filesize

    6.1MB

  • memory/1056-134-0x000000000ABC0000-0x000000000ACCA000-memory.dmp

    Filesize

    1.0MB

  • memory/1056-135-0x000000000AAD0000-0x000000000AAE2000-memory.dmp

    Filesize

    72KB

  • memory/1056-136-0x000000000AB30000-0x000000000AB6C000-memory.dmp

    Filesize

    240KB

  • memory/1056-137-0x000000000BCA0000-0x000000000C244000-memory.dmp

    Filesize

    5.6MB

  • memory/1056-138-0x000000000AF90000-0x000000000B022000-memory.dmp

    Filesize

    584KB

  • memory/1056-139-0x000000000B030000-0x000000000B096000-memory.dmp

    Filesize

    408KB

  • memory/1056-140-0x000000000C420000-0x000000000C5E2000-memory.dmp

    Filesize

    1.8MB

  • memory/1056-141-0x000000000CB20000-0x000000000D04C000-memory.dmp

    Filesize

    5.2MB

  • memory/1056-142-0x000000000C2B0000-0x000000000C326000-memory.dmp

    Filesize

    472KB

  • memory/1056-143-0x000000000C330000-0x000000000C380000-memory.dmp

    Filesize

    320KB