Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2023, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe
Resource
win10v2004-20221111-en
General
-
Target
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe
-
Size
7.5MB
-
MD5
1eb2ae579489e4c883f85747a7d2c9fa
-
SHA1
6b8c79bb8e2a5131af6c122320f1dfa0de1672f6
-
SHA256
39492736e783427a68a791ca3d17fa3bad096cda54846bbf54e53ab3bb0f2633
-
SHA512
09566ef57edb4f3e16fc6fce66f672f9fe202779e637b9ad04e8b4d9a8b54bbbfe618fffe8b3a7fc68d15ae48449675089f40260ab09396a670bd5cfe2abab6c
-
SSDEEP
98304:4w6Tks8Ip9y88/gE1k8cIjNnoeXsU11HK3rt2avguB4et/vEw4KLOqcCLj1J1cNE:47Tks8I78bkKjNnjsU11g
Malware Config
Extracted
redline
UniverseCity100
80.89.228.168:5007
-
auth_value
a16f64012f1825f5b9cc033dc35b580f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2800 set thread context of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 1096 InstallUtil.exe 1096 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe Token: SeDebugPrivilege 1096 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1724 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 80 PID 2800 wrote to memory of 1724 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 80 PID 2800 wrote to memory of 1724 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 80 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81 PID 2800 wrote to memory of 1096 2800 6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe"C:\Users\Admin\AppData\Local\Temp\6b8c79bb8e2a5131af6c122320f1dfa0de1672f6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:1724
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096
-