Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
55s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/01/2023, 19:33
Static task
static1
Behavioral task
behavioral1
Sample
42a7f93250c5512797946e177cbaf44dfbed5d58.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
42a7f93250c5512797946e177cbaf44dfbed5d58.exe
Resource
win10v2004-20220901-en
General
-
Target
42a7f93250c5512797946e177cbaf44dfbed5d58.exe
-
Size
856KB
-
MD5
beeb5de149b4c472848421bee7416093
-
SHA1
42a7f93250c5512797946e177cbaf44dfbed5d58
-
SHA256
084d376d323c8eb5d77a446295a94f236bb93945a4df6cdd5b96ba517584963e
-
SHA512
22d165f268fca102ce2197e73d657f30d3e96eb5eaa3e7daf3cf6aeec4dbfeab9ed1be4a4a791fc386dcd8198dfb60c81aa6eb1a4679978ed1c738dc1b037153
-
SSDEEP
3072:ivS07xLCZ3IhEq6OdmpBf65NvDaNN5CEddUHzNJNMsnSJ9NJCHwFwkNEqWX/ODsv:ivS09LCZ3IhE5egMrXd
Malware Config
Extracted
redline
168.119.228.126:11552
-
auth_value
ee2d0ef2a4d0cbee5b6303070e44cb8a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 6 IoCs
resource yara_rule behavioral1/memory/1616-58-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/1616-59-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/1616-61-0x000000000042280E-mapping.dmp family_redline behavioral1/memory/1616-60-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/1616-63-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral1/memory/1616-65-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1956 set thread context of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1616 csc.exe 1616 csc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1616 csc.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1720 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 29 PID 1956 wrote to memory of 1720 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 29 PID 1956 wrote to memory of 1720 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 29 PID 1956 wrote to memory of 1720 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 29 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30 PID 1956 wrote to memory of 1616 1956 42a7f93250c5512797946e177cbaf44dfbed5d58.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a7f93250c5512797946e177cbaf44dfbed5d58.exe"C:\Users\Admin\AppData\Local\Temp\42a7f93250c5512797946e177cbaf44dfbed5d58.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:1720
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-