Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18/10/2022, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
2.6MB
-
MD5
2a70ae580def1610cd82e17af3a68732
-
SHA1
2b6371fe0a9748b6f12981a7d91f388b8f4708c6
-
SHA256
9d0d4efa6ce4cd3d21d8cdc6c8fd494bb6eebebdc2bde1afe22989f3b09544b0
-
SHA512
f8e0cd0c252df33068cc684a90f8eae1dcb054259f87d4080548c9ee677f50424db4c33ed11355aa2f6f2ff7301cf2b6bd6e3ce85107ff77e2f2464ab2334b30
-
SSDEEP
24576:01zCR848YIy3+RY+Y5Me/bfM+S0swdNAOmi/n2ECqoHY3zclKY72yELu4Dl3RuQO:01uRVky3tR2EeGCKY72yEBl3u
Malware Config
Extracted
redline
new10181
denestyenol.xyz:81
exirdonanos.xyz:81
-
auth_value
9c9460be2b03696a2927339c6ea79201
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
resource yara_rule behavioral1/memory/98380-56-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/98380-61-0x000000000042216A-mapping.dmp family_redline behavioral1/memory/98380-62-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/98380-63-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 564 set thread context of 98380 564 file.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 98380 vbc.exe 98380 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 98380 vbc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 564 wrote to memory of 98380 564 file.exe 28 PID 564 wrote to memory of 98380 564 file.exe 28 PID 564 wrote to memory of 98380 564 file.exe 28 PID 564 wrote to memory of 98380 564 file.exe 28 PID 564 wrote to memory of 98380 564 file.exe 28 PID 564 wrote to memory of 98380 564 file.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:98380
-