Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    211s
  • max time network
    202s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 21:02

General

  • Target

    Roblox Executor/Injector.exe

  • Size

    2.6MB

  • MD5

    0c94ffa43eda8dbb9d4213d63f96dec9

  • SHA1

    8b4c7361470e331a3edf9ef94aff20facff342c2

  • SHA256

    6686e809c825c1f19b849e66e542f673c477832f2ab37b033d840e44ac82277a

  • SHA512

    2909a71b1cf2eb8df9d094067829b1b5910a5deb6c97bddfbc84b32be8f16b4a8e49560487cbaeaf29b4c078a6c28302a6518b23d08f1835d832854162d8ca15

  • SSDEEP

    49152:FEbIpbiqzH1bjD0nSRtcqCygeAVfyJ3il30:FMIpbiqzJjeSI5ZrfyJ3X

Malware Config

Extracted

Family

redline

Botnet

@watashiwokorose

C2

77.73.133.19:31892

Attributes
  • auth_value

    45f131fc4fd6dd7d4b2f3e957f83960d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Roblox Executor\Injector.exe
    "C:\Users\Admin\AppData\Local\Temp\Roblox Executor\Injector.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:98424
      • C:\Users\Admin\AppData\Local\Temp\fl.exe
        "C:\Users\Admin\AppData\Local\Temp\fl.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:98824
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:100184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\fl.exe

    Filesize

    1.4MB

    MD5

    681503845aa49b8b7a3425508cb32dd7

    SHA1

    60c74d61e5ae32e8bb7f8180318b76a4f2695069

    SHA256

    0efba85b07354c1f9d55fa4b4a91194111ada55f9bf30cee718db1fe1f26939e

    SHA512

    d48ce0d4b93eb5fc9aa9c1a8039bdd23d0cadc4841adf966a1e86b280c7c0001c489d99eb5062305399e2a4c37af7b785bf7ac7bacf0c74ef5e5887749ba7ef6

  • \Users\Admin\AppData\Local\Temp\fl.exe

    Filesize

    1.4MB

    MD5

    681503845aa49b8b7a3425508cb32dd7

    SHA1

    60c74d61e5ae32e8bb7f8180318b76a4f2695069

    SHA256

    0efba85b07354c1f9d55fa4b4a91194111ada55f9bf30cee718db1fe1f26939e

    SHA512

    d48ce0d4b93eb5fc9aa9c1a8039bdd23d0cadc4841adf966a1e86b280c7c0001c489d99eb5062305399e2a4c37af7b785bf7ac7bacf0c74ef5e5887749ba7ef6

  • \Users\Admin\AppData\Local\Temp\fl.exe

    Filesize

    1.4MB

    MD5

    681503845aa49b8b7a3425508cb32dd7

    SHA1

    60c74d61e5ae32e8bb7f8180318b76a4f2695069

    SHA256

    0efba85b07354c1f9d55fa4b4a91194111ada55f9bf30cee718db1fe1f26939e

    SHA512

    d48ce0d4b93eb5fc9aa9c1a8039bdd23d0cadc4841adf966a1e86b280c7c0001c489d99eb5062305399e2a4c37af7b785bf7ac7bacf0c74ef5e5887749ba7ef6

  • memory/98424-64-0x0000000076031000-0x0000000076033000-memory.dmp

    Filesize

    8KB

  • memory/98424-63-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/98424-54-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/98424-62-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/98424-56-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/100184-70-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/100184-72-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/100184-79-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/100184-78-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB