Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    18s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2022, 21:26

General

  • Target

    Setup.exe

  • Size

    739.9MB

  • MD5

    da03cbe050932b35ccb6eb09eddae4f8

  • SHA1

    1cc5786cdf9cd4c09d33b89c0ef8ec83d719d050

  • SHA256

    6b7f08cef7e04fc59d680cc4151cd00fa0c3366ee30f9e42534822c61906bcdf

  • SHA512

    a6dda04f333c9e6350976b629a73acb5db4b0cc9e0556960fccb32752010239ca20600686533d2ea0b766da30c9237fbb990bcae6d39e70b2440148b0619f1a6

  • SSDEEP

    3072:TbVLPY8Oqb1GXtquUbPFieoqDJMxU4vTmjiYwqRTsaBuJHPNXJ5xaJVYYPwioGu+:tDd0XtjlxU3BglPN55xowixuYH

Malware Config

Extracted

Family

redline

Botnet

1248769308_99

C2

spartanlivestyle.xyz:28786

Attributes
  • auth_value

    c363f8560ff21ea7f695ac60c01c4f74

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1108

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1108-57-0x0000000000080000-0x000000000009E000-memory.dmp

    Filesize

    120KB

  • memory/1108-55-0x0000000000080000-0x000000000009E000-memory.dmp

    Filesize

    120KB

  • memory/1108-63-0x0000000000080000-0x000000000009E000-memory.dmp

    Filesize

    120KB

  • memory/1108-64-0x0000000000080000-0x000000000009E000-memory.dmp

    Filesize

    120KB

  • memory/1536-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

    Filesize

    8KB

  • memory/1536-65-0x0000000000230000-0x000000000026F000-memory.dmp

    Filesize

    252KB