Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    08/06/2023, 05:52

General

  • Target

    0x000800000001231b-111.exe

  • Size

    173KB

  • MD5

    bb8124e7ff844204571138d2b201cd4b

  • SHA1

    84a43f87441a76393bbca4b1cf2830f154f21df6

  • SHA256

    70c07bd88ee798a81d5248b5aeb460c5bd93ba6538e8456723f8d3cebeb55ca8

  • SHA512

    a3eed2875d80aa017d8972a0944322af2fbca21dead5c3bd9ed7a036ea5c5f671e9379d2617611fad86bca85b0cffe2ff18dc3d417ed3d69629979abfbd14f18

  • SSDEEP

    1536:gtaPgzl736sv0W7Tp8JFrH4ySLn1nbAxNTIYQ/dbumgzeFra6l0GkR88e8hZ:g6gJBO0y6RbAxNjgOqFra6l/8e8hZ

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.129:19068

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x000800000001231b-111.exe
    "C:\Users\Admin\AppData\Local\Temp\0x000800000001231b-111.exe"
    1⤵
      PID:1412

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1412-54-0x0000000000D80000-0x0000000000DB0000-memory.dmp

      Filesize

      192KB

    • memory/1412-55-0x0000000000460000-0x0000000000466000-memory.dmp

      Filesize

      24KB

    • memory/1412-56-0x0000000000500000-0x0000000000540000-memory.dmp

      Filesize

      256KB

    • memory/1412-57-0x0000000000500000-0x0000000000540000-memory.dmp

      Filesize

      256KB