Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 05:15

General

  • Target

    x0543664.exe

  • Size

    291KB

  • MD5

    d72e8eb9bc5f8e9b119f39216631733b

  • SHA1

    d8e29c1d02381d7339910f4f0aed1e0fc4e9fea9

  • SHA256

    6508ea148ad32be86b59cadc266e2a72343e0dc3896742fd74bc324cb1a5ef57

  • SHA512

    9b3a3188b794d03302d6657c834fcfa45d008a402e426afa36f17e28b8d20bbfc3d7a597e9d03e633f23db638751b40de90c3914882779d5da7bd0b902c8aa74

  • SSDEEP

    6144:Kry+bnr+jp0yN90QEGAV5HR0zwDm88tH50brv3zFq:dMrjy907cHIbj3g

Malware Config

Extracted

Family

redline

Botnet

tuxiu

C2

77.91.124.82:19071

Attributes
  • auth_value

    29610cdad07e7187eec70685a04b89fe

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\x0543664.exe
    "C:\Users\Admin\AppData\Local\Temp\x0543664.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8131180.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8131180.exe
      2⤵
      • Executes dropped EXE
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8131180.exe

    Filesize

    174KB

    MD5

    ac0b8c45614a0b94074d9f7a4cc76f38

    SHA1

    240b5d17766503fd7dfa2a7f8f05be2f7857dc8a

    SHA256

    d7aa1acf2186822f215379df2f4731a9502aa6802dd8f4c87431e68ffb82fc74

    SHA512

    70abd5c774de1df94d4f89f6fc16734012135b1bab6c21f00da133c5f8194941f4bf118c449b8dd02ac087ff729bca63227140c56bebdaa7cefba560866ebff4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h8131180.exe

    Filesize

    174KB

    MD5

    ac0b8c45614a0b94074d9f7a4cc76f38

    SHA1

    240b5d17766503fd7dfa2a7f8f05be2f7857dc8a

    SHA256

    d7aa1acf2186822f215379df2f4731a9502aa6802dd8f4c87431e68ffb82fc74

    SHA512

    70abd5c774de1df94d4f89f6fc16734012135b1bab6c21f00da133c5f8194941f4bf118c449b8dd02ac087ff729bca63227140c56bebdaa7cefba560866ebff4

  • memory/2660-7-0x0000000073EF0000-0x00000000746A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2660-8-0x0000000000820000-0x0000000000850000-memory.dmp

    Filesize

    192KB

  • memory/2660-9-0x0000000002B00000-0x0000000002B06000-memory.dmp

    Filesize

    24KB

  • memory/2660-10-0x00000000058D0000-0x0000000005EE8000-memory.dmp

    Filesize

    6.1MB

  • memory/2660-11-0x00000000053C0000-0x00000000054CA000-memory.dmp

    Filesize

    1.0MB

  • memory/2660-12-0x00000000052F0000-0x0000000005302000-memory.dmp

    Filesize

    72KB

  • memory/2660-13-0x00000000051A0000-0x00000000051B0000-memory.dmp

    Filesize

    64KB

  • memory/2660-14-0x0000000005350000-0x000000000538C000-memory.dmp

    Filesize

    240KB

  • memory/2660-15-0x00000000054D0000-0x000000000551C000-memory.dmp

    Filesize

    304KB

  • memory/2660-16-0x0000000073EF0000-0x00000000746A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2660-17-0x00000000051A0000-0x00000000051B0000-memory.dmp

    Filesize

    64KB