Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2022, 17:01

General

  • Target

    CACF8655A767034B75770412018127F044B6543A6432B.exe

  • Size

    404KB

  • MD5

    c3401b50b3b292190403579fc6322d1a

  • SHA1

    abf34a111a328bc7605f0d12d5906ea0630afa27

  • SHA256

    cacf8655a767034b75770412018127f044b6543a6432b9d616042a5385dd062d

  • SHA512

    6b5183393fed60ce7b58c69f7a1f43b106cddf548ae3d97d431cdf4a4c21b2b24edf4f45bd610112a4eac339aeb6299368abd754f9ba67610df1b1087c3c929a

  • SSDEEP

    12288:orm6+9Ogo3md7AUuxk39R17uIhIp2VZc:I+pyw39R17u72

Score
10/10

Malware Config

Extracted

Family

redline

Botnet

787

C2

linevanarsor.xyz:80

Attributes
  • auth_value

    25cd5ed9d70109d59cc46eeda8034e2b

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CACF8655A767034B75770412018127F044B6543A6432B.exe
    "C:\Users\Admin\AppData\Local\Temp\CACF8655A767034B75770412018127F044B6543A6432B.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1956-54-0x0000000001E50000-0x0000000001E84000-memory.dmp

    Filesize

    208KB

  • memory/1956-55-0x0000000001FD0000-0x0000000002004000-memory.dmp

    Filesize

    208KB

  • memory/1956-57-0x0000000000220000-0x000000000025A000-memory.dmp

    Filesize

    232KB

  • memory/1956-56-0x000000000062B000-0x0000000000658000-memory.dmp

    Filesize

    180KB

  • memory/1956-58-0x0000000000400000-0x000000000047C000-memory.dmp

    Filesize

    496KB

  • memory/1956-59-0x0000000075141000-0x0000000075143000-memory.dmp

    Filesize

    8KB

  • memory/1956-60-0x000000000062B000-0x0000000000658000-memory.dmp

    Filesize

    180KB