Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    34s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    02/07/2023, 13:10

General

  • Target

    281499169b25ba8d2058dfdca70ae05f.exe

  • Size

    262KB

  • MD5

    281499169b25ba8d2058dfdca70ae05f

  • SHA1

    357108e6a161bb324f082e26dea2e9cdfe5ef9f3

  • SHA256

    e85dac3cec39b116d458adf891f703fc805d3e360f3d0b65f707b0103f9bf5c6

  • SHA512

    18d0fa28188c077d2bd7e406ccf21aae70bfe51f6b83c7e389ad2e5bfa06e50e58853b53f375618a1eb210e43ce4e83e656c60870e8e09312257dfdeff01c7a9

  • SSDEEP

    3072:6J2hNclh9ZUuWA4bZEtyTFqvPXTTR6H+KH4DDyXAjqpRm7MRTr5yOauYrbRulcp7:3RuobZAzV6H+KHaDyXbbmIRf0Vay

Malware Config

Extracted

Family

redline

Botnet

bruno

C2

83.97.73.134:19071

Attributes
  • auth_value

    b23e240c277e85ce9d49d6165c0a2b48

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\281499169b25ba8d2058dfdca70ae05f.exe
    "C:\Users\Admin\AppData\Local\Temp\281499169b25ba8d2058dfdca70ae05f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1268

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1268-54-0x0000000000300000-0x0000000000330000-memory.dmp

    Filesize

    192KB

  • memory/1268-58-0x0000000000510000-0x0000000000516000-memory.dmp

    Filesize

    24KB

  • memory/1268-59-0x00000000046C0000-0x0000000004700000-memory.dmp

    Filesize

    256KB