Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2023, 21:43
Static task
static1
Behavioral task
behavioral1
Sample
Intrunkhypho.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Intrunkhypho.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Intrunkhypho.exe
-
Size
278KB
-
MD5
8866c407a31bcd11e2456843519f5109
-
SHA1
068d8ebf28711bc63445932a39b564ac07527aad
-
SHA256
83ded684d8501ecbb679d59ec349c702930aba7e3aea673ef92894e23b615d5e
-
SHA512
c22f34790e805313eabfef72d46b9b834bacdb642f4f5fa944bb16b2bec8a8f20fc46fc1687f624e74843c046025c46c08f733722fec99f83c2b3db26fa24095
-
SSDEEP
6144:O6FkdWDZKNjcsnyb+GU52LLzEokiqKsnhJIBDwKjWDhDocX3S:Gx0BFTEokiqJmhgxn
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
Тест2
C2
77.73.134.6:12530
Attributes
-
auth_value
921a47f6e46cb473dd2ea93241d337aa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4752 set thread context of 224 4752 Intrunkhypho.exe 88 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe 4752 Intrunkhypho.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4752 Intrunkhypho.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88 PID 4752 wrote to memory of 224 4752 Intrunkhypho.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Intrunkhypho.exe"C:\Users\Admin\AppData\Local\Temp\Intrunkhypho.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe2⤵PID:224
-