Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2023, 08:41 UTC

General

  • Target

    f0283055exeexeexeexeexeex.exe

  • Size

    265KB

  • MD5

    018410d71073adbefc17ccc8fdb4dcea

  • SHA1

    1c86e416188090dc4eb5113229816020d975554f

  • SHA256

    a12f7887bbcad49b11f463da264c952d92c08b2a05ea8d37102eb673828e7145

  • SHA512

    4bd9cfe1879cb9767dbc2a4df1195867e5391cec4dabe7d7138b62aea031a497abec3719816899f9dd4eb204aea9b7f25bfe85b87dcab2e292ad99870ff004af

  • SSDEEP

    6144:MLulVrmzXc3FV4uYzXTVfR5HE+aX+iexf2EtQuk2K6mVnMg0UTDa:IuXmo3FGuYzXTiXGxf2EtQuk2K6mVnM8

Malware Config

Extracted

Family

redline

Botnet

furod

C2

77.91.68.70:19073

Attributes
  • auth_value

    d2386245fe11799b28b4521492a5879d

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

Processes

  • C:\Users\Admin\AppData\Local\Temp\f0283055exeexeexeexeexeex.exe
    "C:\Users\Admin\AppData\Local\Temp\f0283055exeexeexeexeexeex.exe"
    1⤵
      PID:1096

    Network

      No results found
    • 77.91.68.70:19073
      f0283055exeexeexeexeexeex.exe
      152 B
      3
    • 77.91.68.70:19073
      f0283055exeexeexeexeexeex.exe
      152 B
      3
    • 77.91.68.70:19073
      f0283055exeexeexeexeexeex.exe
      152 B
      3
    • 77.91.68.70:19073
      f0283055exeexeexeexeexeex.exe
      152 B
      3
    • 77.91.68.70:19073
      f0283055exeexeexeexeexeex.exe
      152 B
      3
    • 77.91.68.70:19073
      f0283055exeexeexeexeexeex.exe
      104 B
      2
    No results found

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1096-54-0x0000000000230000-0x0000000000260000-memory.dmp

      Filesize

      192KB

    • memory/1096-58-0x00000000003E0000-0x00000000003E6000-memory.dmp

      Filesize

      24KB

    • memory/1096-59-0x00000000046F0000-0x0000000004730000-memory.dmp

      Filesize

      256KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.