Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2022, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
2.6MB
-
MD5
2a70ae580def1610cd82e17af3a68732
-
SHA1
2b6371fe0a9748b6f12981a7d91f388b8f4708c6
-
SHA256
9d0d4efa6ce4cd3d21d8cdc6c8fd494bb6eebebdc2bde1afe22989f3b09544b0
-
SHA512
f8e0cd0c252df33068cc684a90f8eae1dcb054259f87d4080548c9ee677f50424db4c33ed11355aa2f6f2ff7301cf2b6bd6e3ce85107ff77e2f2464ab2334b30
-
SSDEEP
24576:01zCR848YIy3+RY+Y5Me/bfM+S0swdNAOmi/n2ECqoHY3zclKY72yELu4Dl3RuQO:01uRVky3tR2EeGCKY72yEBl3u
Malware Config
Extracted
redline
new10181
denestyenol.xyz:81
exirdonanos.xyz:81
-
auth_value
9c9460be2b03696a2927339c6ea79201
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/100292-133-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3496 set thread context of 100292 3496 file.exe 81 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 100292 vbc.exe 100292 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 100292 vbc.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3496 wrote to memory of 100292 3496 file.exe 81 PID 3496 wrote to memory of 100292 3496 file.exe 81 PID 3496 wrote to memory of 100292 3496 file.exe 81 PID 3496 wrote to memory of 100292 3496 file.exe 81 PID 3496 wrote to memory of 100292 3496 file.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:100292
-