Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2023, 01:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230220-en
3 signatures
150 seconds
General
-
Target
file.exe
-
Size
437KB
-
MD5
6ca0cd72acd293137a7aa149a046591a
-
SHA1
8714ebb20b3174507498a51a86d3f1da4a9e700e
-
SHA256
b3755eb8f78e65b8bf54279583995deaa3b7dc55f192b2ec80df204471f64080
-
SHA512
7f71848e011e22cb27f2ed53f60d312f51e149601d6f12d49844cb21119efca2cb88201f7abb6bea2165934f92fcc2e95a4fa0ebd4e384bb90f1200bddb4bba4
-
SSDEEP
6144:2uEZPdqXIQvqXx5CTB2wrEMrSCCAiLcI8AI2UFw1QAz67v7cTP:2Pda/qh5QB9EiBC5cI85dZk
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 41 IoCs
resource yara_rule behavioral1/memory/1552-55-0x00000000024C0000-0x0000000002504000-memory.dmp family_redline behavioral1/memory/1552-58-0x00000000026C0000-0x0000000002700000-memory.dmp family_redline behavioral1/memory/1552-59-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-60-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-62-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-64-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-72-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-70-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-68-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-66-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-76-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-74-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-80-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-78-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-88-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-86-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-84-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-82-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-90-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-92-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-94-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-96-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-98-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-102-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-100-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-106-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-104-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-110-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-108-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-114-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-112-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-116-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-118-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-122-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-120-0x00000000026C0000-0x00000000026FC000-memory.dmp family_redline behavioral1/memory/1552-257-0x0000000004F70000-0x0000000004FB0000-memory.dmp family_redline behavioral1/memory/1552-259-0x0000000004F70000-0x0000000004FB0000-memory.dmp family_redline behavioral1/memory/1552-969-0x0000000004F70000-0x0000000004FB0000-memory.dmp family_redline behavioral1/memory/1552-973-0x0000000004F70000-0x0000000004FB0000-memory.dmp family_redline behavioral1/memory/1552-974-0x0000000004F70000-0x0000000004FB0000-memory.dmp family_redline behavioral1/memory/1552-975-0x0000000004F70000-0x0000000004FB0000-memory.dmp family_redline -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1552 file.exe