Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20/04/2023, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe
Resource
win10v2004-20230220-en
General
-
Target
089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe
-
Size
346KB
-
MD5
089a8afdbd2da31e6180ea0d8a85b3e1
-
SHA1
7126a510297ca035b255abbeefab4385830b3ab2
-
SHA256
319875a4c7898ae0f636f5ee26e14172008724c4567eacfba7a36aa4b2a413c4
-
SHA512
584bcf8e1b5e0dc90cf2f26a7896f8bd19dfdbc461d3d1e241e4643db2782b67acecb7c9687044658cfb1a44f73e68351513ff5108d17b26ed7d85268d2d7d0f
-
SSDEEP
6144:cT11Ka2T5jBmjEKCPcuyflTX8deh8I5jAriUzU:cT1aTvmjZCZolT+I5Urh
Malware Config
Extracted
redline
@COSMICCLOUDADMIN
20.226.69.130:30497
-
auth_value
0c9b7221bd50ac4f7beb692ba88b2c78
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1192 set thread context of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1112 AppLaunch.exe 1112 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1112 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29 PID 1192 wrote to memory of 1112 1192 089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe"C:\Users\Admin\AppData\Local\Temp\089a8afdbd2da31e6180ea0d8a85b3e1.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1112
-