Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
23/05/2023, 22:20
General
-
Target
e30685351e19586be44e2524f2941e819ad07e94ba21f3442ea91ace3090aab5.exe
-
Size
302KB
-
MD5
78c06eb25e3a112f1194c2d06f6a218a
-
SHA1
f692bb3955742b01c73ab5afeb0d5d16856adeed
-
SHA256
e30685351e19586be44e2524f2941e819ad07e94ba21f3442ea91ace3090aab5
-
SHA512
97fbcc24ed00474e416edb4def3f6f7c2f397aaac624e52e26af10b8bc8d7740c337e6538a32e912cd4a45e5fe1da7a099f2f041fbd138f567cb80847ae223ca
-
SSDEEP
6144:1LqymFDZhIV4p4p4RrDM/J63lTYZWvtbLxv4EP:0DDIViiGDMBMZvZLSE
Score
10/10
Malware Config
Extracted
Family
redline
C2
135.181.10.136:4328
Attributes
-
auth_value
a909e2aaecf96137978fea4f86400b9b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30685351e19586be44e2524f2941e819ad07e94ba21f3442ea91ace3090aab5.exe"C:\Users\Admin\AppData\Local\Temp\e30685351e19586be44e2524f2941e819ad07e94ba21f3442ea91ace3090aab5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
256KB