Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    03444499.exe

  • Size

    764KB

  • Sample

    230526-ja2tzaeh61

  • MD5

    6ff8a33bc4c0403f96c766abb6c1b0a5

  • SHA1

    73be04394e09642e28a4f0a3aa530bf512c39ed2

  • SHA256

    1c6d03c32d32bc02c8cbdbf57cb427660b055f9a4b08f62f86eff4f518a3028f

  • SHA512

    a74121d068f66ffeac8e3713e17fa308a65e8914c55a0e2510074c91c31abd55f0f96111cbb482755ba494110ab3a93026b5368e3780b0b0cf9c011638dfd1c0

  • SSDEEP

    12288:6Mrpy90k1bCtI5vBPlqxUyOLfP168JW52kOXTAxKPCS7YeBI/kBp1nM6tIY+UEST:DyZ2IprqWyOJdiDOXU83Y8ikn1M63+tS

Malware Config

Extracted

Family

redline

Botnet

dina

C2

83.97.73.122:19062

Attributes
  • auth_value

    4f77073adc624269de1bff760b9bc471

Extracted

Family

redline

Botnet

greg

C2

83.97.73.122:19062

Attributes
  • auth_value

    4c966a90781c6b4ab7f512d018696362

Targets

    • Target

      03444499.exe

    • Size

      764KB

    • MD5

      6ff8a33bc4c0403f96c766abb6c1b0a5

    • SHA1

      73be04394e09642e28a4f0a3aa530bf512c39ed2

    • SHA256

      1c6d03c32d32bc02c8cbdbf57cb427660b055f9a4b08f62f86eff4f518a3028f

    • SHA512

      a74121d068f66ffeac8e3713e17fa308a65e8914c55a0e2510074c91c31abd55f0f96111cbb482755ba494110ab3a93026b5368e3780b0b0cf9c011638dfd1c0

    • SSDEEP

      12288:6Mrpy90k1bCtI5vBPlqxUyOLfP168JW52kOXTAxKPCS7YeBI/kBp1nM6tIY+UEST:DyZ2IprqWyOJdiDOXU83Y8ikn1M63+tS

    • Modifies Windows Defender Real-time Protection settings

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks