Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    204s
  • max time network
    222s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 22:35

General

  • Target

    70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe

  • Size

    382KB

  • MD5

    91e3081c35f8fbc3c5d82a127905ea3d

  • SHA1

    c33f12ff653b4b2817b267a2eb42a36ed0f80027

  • SHA256

    70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a

  • SHA512

    485242ff08e9ae43f2399368b2faccc3218200bbfe4e6e969196b4590f034e3c1baf2f00d4c3d24d4c7acbfa8f82c2363030ae4e2584a6b462bb904426cc017a

  • SSDEEP

    6144:QnAe2Way5hWybjlV1VDWiZuAOEp9hlh1Jm/dd37BkslF6Lw8y:QAl1y5hNbDlu4lh1cFd37BZ2w8y

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

51.38.95.107:42494

Attributes
  • auth_value

    c2955ed3813a798683a185a82e949f88

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\70c38d1be3249f03e593da38ce9ae3ba1de2375a03ae8becda9036de762a685a_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
        PID:5040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 260
        2⤵
        • Program crash
        PID:4348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3768 -ip 3768
      1⤵
        PID:4568

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5040-0-0x0000000000400000-0x0000000000430000-memory.dmp

        Filesize

        192KB

      • memory/5040-1-0x0000000074520000-0x0000000074CD0000-memory.dmp

        Filesize

        7.7MB

      • memory/5040-2-0x0000000000E10000-0x0000000000E16000-memory.dmp

        Filesize

        24KB

      • memory/5040-3-0x0000000074520000-0x0000000074CD0000-memory.dmp

        Filesize

        7.7MB

      • memory/5040-4-0x0000000005580000-0x0000000005B98000-memory.dmp

        Filesize

        6.1MB

      • memory/5040-5-0x00000000050E0000-0x00000000051EA000-memory.dmp

        Filesize

        1.0MB

      • memory/5040-6-0x0000000005020000-0x0000000005032000-memory.dmp

        Filesize

        72KB

      • memory/5040-7-0x00000000026E0000-0x00000000026F0000-memory.dmp

        Filesize

        64KB

      • memory/5040-8-0x0000000005080000-0x00000000050BC000-memory.dmp

        Filesize

        240KB

      • memory/5040-9-0x00000000026E0000-0x00000000026F0000-memory.dmp

        Filesize

        64KB

      • memory/5040-10-0x00000000051F0000-0x000000000523C000-memory.dmp

        Filesize

        304KB