Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2022, 03:37

General

  • Target

    efc3a3898793c96441300f798990ffb68274694d21495ebd2a1bb2bb0645a3d9.exe

  • Size

    363KB

  • MD5

    2fdfd51c0d7f67cffd5cbd1d288ffb3b

  • SHA1

    e13eb0c0bae02eed3c5e6a7211ac35ca7cf9cca8

  • SHA256

    efc3a3898793c96441300f798990ffb68274694d21495ebd2a1bb2bb0645a3d9

  • SHA512

    cbf4a8bd277cf121eeeeb1aec0abc6ac654a6dc7e9d3b1133489ec73a57534c99fdfa5ad97479889e17123f553da91b3efd777670775983445b49ecc1ce459e0

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efc3a3898793c96441300f798990ffb68274694d21495ebd2a1bb2bb0645a3d9.exe
    "C:\Users\Admin\AppData\Local\Temp\efc3a3898793c96441300f798990ffb68274694d21495ebd2a1bb2bb0645a3d9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2424

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2424-132-0x0000000000B80000-0x0000000000BE0000-memory.dmp

    Filesize

    384KB

  • memory/2424-133-0x000000000B250000-0x000000000B868000-memory.dmp

    Filesize

    6.1MB

  • memory/2424-134-0x000000000AD90000-0x000000000AE9A000-memory.dmp

    Filesize

    1.0MB

  • memory/2424-135-0x000000000ACC0000-0x000000000ACD2000-memory.dmp

    Filesize

    72KB

  • memory/2424-136-0x000000000AD20000-0x000000000AD5C000-memory.dmp

    Filesize

    240KB

  • memory/2424-137-0x000000000C020000-0x000000000C5C4000-memory.dmp

    Filesize

    5.6MB

  • memory/2424-138-0x000000000BA70000-0x000000000BB02000-memory.dmp

    Filesize

    584KB

  • memory/2424-139-0x000000000BB10000-0x000000000BB76000-memory.dmp

    Filesize

    408KB

  • memory/2424-140-0x000000000BE10000-0x000000000BE86000-memory.dmp

    Filesize

    472KB

  • memory/2424-141-0x000000000BE90000-0x000000000BEE0000-memory.dmp

    Filesize

    320KB

  • memory/2424-142-0x000000000C7A0000-0x000000000C962000-memory.dmp

    Filesize

    1.8MB

  • memory/2424-143-0x000000000CEA0000-0x000000000D3CC000-memory.dmp

    Filesize

    5.2MB