Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
204s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe
-
Size
382KB
-
MD5
91e3081c35f8fbc3c5d82a127905ea3d
-
SHA1
c33f12ff653b4b2817b267a2eb42a36ed0f80027
-
SHA256
70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a
-
SHA512
485242ff08e9ae43f2399368b2faccc3218200bbfe4e6e969196b4590f034e3c1baf2f00d4c3d24d4c7acbfa8f82c2363030ae4e2584a6b462bb904426cc017a
-
SSDEEP
6144:QnAe2Way5hWybjlV1VDWiZuAOEp9hlh1Jm/dd37BkslF6Lw8y:QAl1y5hNbDlu4lh1cFd37BZ2w8y
Malware Config
Extracted
redline
LogsDiller Cloud (Telegram: @logsdillabot)
51.38.95.107:42494
-
auth_value
c2955ed3813a798683a185a82e949f88
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3768 set thread context of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 -
Program crash 1 IoCs
pid pid_target Process procid_target 4348 3768 WerFault.exe 47 -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84 PID 3768 wrote to memory of 5040 3768 70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe"C:\Users\Admin\AppData\Local\Temp\70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:5040
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 2602⤵
- Program crash
PID:4348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3768 -ip 37681⤵PID:4568