Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/08/2023, 09:26

General

  • Target

    f6b5fed2060fc3b039b37a54eb3ee3f92630c11f37c0150a25a3500c7e499e98.exe

  • Size

    416KB

  • MD5

    86ea3b8bdb2f645d47d177faf622c3e1

  • SHA1

    7af0cc49835dc1951037242962507015ec503baf

  • SHA256

    f6b5fed2060fc3b039b37a54eb3ee3f92630c11f37c0150a25a3500c7e499e98

  • SHA512

    9f2d9b00b133252dd5eb051c83e0fa41c4e9bbd81e7940f7322c9bca1ad885605f317330e5f43b69dc33dc5a8386817fee0d8a603ddc756b7db68da7b728968c

  • SSDEEP

    6144:h4qmHABcWSa2pBbu7/mi281loEeSehDpi:hBNxNYgdxlRwu

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

51.89.201.49:6932

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6b5fed2060fc3b039b37a54eb3ee3f92630c11f37c0150a25a3500c7e499e98.exe
    "C:\Users\Admin\AppData\Local\Temp\f6b5fed2060fc3b039b37a54eb3ee3f92630c11f37c0150a25a3500c7e499e98.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3752

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3752-122-0x0000000002360000-0x0000000002460000-memory.dmp

    Filesize

    1024KB

  • memory/3752-123-0x0000000003F30000-0x0000000003F6F000-memory.dmp

    Filesize

    252KB

  • memory/3752-124-0x00000000041F0000-0x0000000004228000-memory.dmp

    Filesize

    224KB

  • memory/3752-126-0x0000000000400000-0x000000000230E000-memory.dmp

    Filesize

    31.1MB

  • memory/3752-125-0x0000000006A30000-0x0000000006F2E000-memory.dmp

    Filesize

    5.0MB

  • memory/3752-129-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-128-0x0000000004380000-0x00000000043B4000-memory.dmp

    Filesize

    208KB

  • memory/3752-127-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-130-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-132-0x0000000073420000-0x0000000073B0E000-memory.dmp

    Filesize

    6.9MB

  • memory/3752-131-0x00000000043B0000-0x00000000043B6000-memory.dmp

    Filesize

    24KB

  • memory/3752-133-0x000000000C3B0000-0x000000000C9B6000-memory.dmp

    Filesize

    6.0MB

  • memory/3752-134-0x000000000C9C0000-0x000000000CACA000-memory.dmp

    Filesize

    1.0MB

  • memory/3752-136-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-135-0x000000000CAF0000-0x000000000CB02000-memory.dmp

    Filesize

    72KB

  • memory/3752-137-0x000000000CB10000-0x000000000CB4E000-memory.dmp

    Filesize

    248KB

  • memory/3752-138-0x000000000CBB0000-0x000000000CBFB000-memory.dmp

    Filesize

    300KB

  • memory/3752-139-0x0000000002360000-0x0000000002460000-memory.dmp

    Filesize

    1024KB

  • memory/3752-140-0x0000000000400000-0x000000000230E000-memory.dmp

    Filesize

    31.1MB

  • memory/3752-141-0x0000000003F30000-0x0000000003F6F000-memory.dmp

    Filesize

    252KB

  • memory/3752-142-0x000000000CDF0000-0x000000000CE66000-memory.dmp

    Filesize

    472KB

  • memory/3752-143-0x000000000CE70000-0x000000000CF02000-memory.dmp

    Filesize

    584KB

  • memory/3752-144-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-145-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-146-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-147-0x000000000CF10000-0x000000000CF76000-memory.dmp

    Filesize

    408KB

  • memory/3752-148-0x0000000073420000-0x0000000073B0E000-memory.dmp

    Filesize

    6.9MB

  • memory/3752-149-0x0000000006A20000-0x0000000006A30000-memory.dmp

    Filesize

    64KB

  • memory/3752-150-0x000000000E3E0000-0x000000000E5A2000-memory.dmp

    Filesize

    1.8MB

  • memory/3752-151-0x000000000E5B0000-0x000000000EADC000-memory.dmp

    Filesize

    5.2MB

  • memory/3752-152-0x000000000D850000-0x000000000D8A0000-memory.dmp

    Filesize

    320KB

  • memory/3752-154-0x0000000000400000-0x000000000230E000-memory.dmp

    Filesize

    31.1MB

  • memory/3752-155-0x0000000073420000-0x0000000073B0E000-memory.dmp

    Filesize

    6.9MB