Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2023, 16:37
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220901-en
General
-
Target
file.exe
-
Size
2.1MB
-
MD5
d1433f5b2eada044678af57d87ee31e5
-
SHA1
0493152ee8d18335fa5043be0f80d12331f2ea00
-
SHA256
95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2
-
SHA512
80dcff2d4e4001d8adb4eff0963921e4335c80bde476492996e74762918663bc84627ae9ca73023f75f799143d3101939ce0a599fafa164f9750481e4bb680c2
-
SSDEEP
49152:V5OaOl3UYvrbFueD40EJbAXOUghn/WsAXZ//t:V59Q3UYvrBusTM8OUgNLY
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
51.210.137.6:47909
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation file.exe -
Executes dropped EXE 2 IoCs
pid Process 2156 123.exe 3940 321.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2156 set thread context of 2472 2156 123.exe 87 PID 3940 set thread context of 3464 3940 321.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3292 2156 WerFault.exe 82 1636 3940 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2472 vbc.exe 2472 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2472 vbc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4384 wrote to memory of 2156 4384 file.exe 82 PID 4384 wrote to memory of 2156 4384 file.exe 82 PID 4384 wrote to memory of 2156 4384 file.exe 82 PID 4384 wrote to memory of 3940 4384 file.exe 85 PID 4384 wrote to memory of 3940 4384 file.exe 85 PID 4384 wrote to memory of 3940 4384 file.exe 85 PID 2156 wrote to memory of 2472 2156 123.exe 87 PID 2156 wrote to memory of 2472 2156 123.exe 87 PID 2156 wrote to memory of 2472 2156 123.exe 87 PID 2156 wrote to memory of 2472 2156 123.exe 87 PID 2156 wrote to memory of 2472 2156 123.exe 87 PID 3940 wrote to memory of 3464 3940 321.exe 90 PID 3940 wrote to memory of 3464 3940 321.exe 90 PID 3940 wrote to memory of 3464 3940 321.exe 90 PID 3940 wrote to memory of 3464 3940 321.exe 90 PID 3940 wrote to memory of 3464 3940 321.exe 90 PID 3464 wrote to memory of 620 3464 vbc.exe 93 PID 3464 wrote to memory of 620 3464 vbc.exe 93 PID 3464 wrote to memory of 620 3464 vbc.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\Temp\123.exe"C:\Windows\Temp\123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1523⤵
- Program crash
PID:3292
-
-
-
C:\Windows\Temp\321.exe"C:\Windows\Temp\321.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe4⤵PID:620
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 2403⤵
- Program crash
PID:1636
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2156 -ip 21561⤵PID:4788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3940 -ip 39401⤵PID:2012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5B
MD58b1a9953c4611296a827abf8c47804d7
SHA1f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0
SHA256185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969
SHA5123615f80c9d293ed7402687f94b22d58e529b8cc7916f8fac7fddf7fbd5af4cf777d3d795a7a00a16bf7e7f3fb9561ee9baae480da9fe7a18769e71886b03f315
-
Filesize
1.0MB
MD5ae771c1de075bbc19c94c282dd0d700f
SHA101e03ffabc07e03a87e0153e7f0f473a17180d6a
SHA256ed827b19c613303aea51290ec4554626883a89a17c37c6f6707221cf77cf5ed3
SHA5121a8e92df2210089e9ee8a85c259c8fb5ba1806cb8174e73a1fc41a8574fe5a0cc44eafe5ab0c67807ef1362e4d461b4fdbeb1af16d2547289c172d4a4ff5b3a8
-
Filesize
1.0MB
MD5ae771c1de075bbc19c94c282dd0d700f
SHA101e03ffabc07e03a87e0153e7f0f473a17180d6a
SHA256ed827b19c613303aea51290ec4554626883a89a17c37c6f6707221cf77cf5ed3
SHA5121a8e92df2210089e9ee8a85c259c8fb5ba1806cb8174e73a1fc41a8574fe5a0cc44eafe5ab0c67807ef1362e4d461b4fdbeb1af16d2547289c172d4a4ff5b3a8
-
Filesize
3.4MB
MD5ef82992004a4ecb5d8d938253afce558
SHA1358ff0331fc36fc1871225bc11a5011f72949d7c
SHA25611d2605286141b6f88413e09599d6de68d1ef1f291c73a6198397c5b99baede7
SHA51259f0a00078a6330e1395029e7ede525fdfb086543dbb50f0556f1657bc9f007986703e2f59a0581d91ef4315f370779d06312d052cd8139f439c9d1b8a06247b
-
Filesize
3.4MB
MD5ef82992004a4ecb5d8d938253afce558
SHA1358ff0331fc36fc1871225bc11a5011f72949d7c
SHA25611d2605286141b6f88413e09599d6de68d1ef1f291c73a6198397c5b99baede7
SHA51259f0a00078a6330e1395029e7ede525fdfb086543dbb50f0556f1657bc9f007986703e2f59a0581d91ef4315f370779d06312d052cd8139f439c9d1b8a06247b