Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
Fortnite Hack/Run.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Fortnite Hack/Run.exe
Resource
win10v2004-20220901-en
General
-
Target
Fortnite Hack/Run.exe
-
Size
2.6MB
-
MD5
9b84fd60b5f757255d2aa8207a6c2948
-
SHA1
66a060d8a51aab38b40e7ed173414c29097e9665
-
SHA256
721b2b68367c044a4bab9bc0e67fe7d234011c5fd78624084dd7005934362696
-
SHA512
3d00275cf479150b6ef6bc2e1f81c4a6e26e9169362991d81ca126fd67593664d7c02c624391f1f6b91acc7f1452946be4d098c79ae80395f24d3b27b97aa936
-
SSDEEP
24576:6qvjTagmD2N1apOYpYkAK4BfAM8odd4JulXFoXAVzbrbjL4KGKl3RuQ553134:6WpmD2N1a9vgBVzbrbjMK9l32
Malware Config
Extracted
redline
79.137.192.47:46759
-
auth_value
67c54899f07d261b61aeef71b1ae3f6c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
resource yara_rule behavioral1/memory/98728-56-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/98728-61-0x00000000004227AE-mapping.dmp family_redline behavioral1/memory/98728-62-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/98728-63-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1784 set thread context of 98728 1784 Run.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 98728 AppLaunch.exe 98728 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 98728 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28 PID 1784 wrote to memory of 98728 1784 Run.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite Hack\Run.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite Hack\Run.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:98728
-