Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2023, 15:10

General

  • Target

    file.exe

  • Size

    1.1MB

  • MD5

    f1269255ba88a71955f1ccc2d4576629

  • SHA1

    c13a7009925d564d57d0386386df162287529f50

  • SHA256

    7fe58a57ec935872f4c4d04330cd28bed9ad7838ab7f06722505c04c72eab0a1

  • SHA512

    81d893205522e2e338aefe341bc5e38201cb2a6b2085e9ff28d2b70b0060975a5e1fca21cea397be11794402ab1e477c181c0d067d377a0fcbe220e61c89fd46

  • SSDEEP

    24576:gYzarSx8Xfg+g+tHNbGaqn4/VzSCwU7iG+xFa:gKx8Xfg+g+tHV/H7iGCFa

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

194.49.94.142:41292

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:216
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3916-0-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3916-1-0x0000000074430000-0x0000000074BE0000-memory.dmp

    Filesize

    7.7MB

  • memory/3916-2-0x0000000007BA0000-0x0000000008144000-memory.dmp

    Filesize

    5.6MB

  • memory/3916-3-0x00000000076D0000-0x0000000007762000-memory.dmp

    Filesize

    584KB

  • memory/3916-4-0x0000000007650000-0x0000000007660000-memory.dmp

    Filesize

    64KB

  • memory/3916-5-0x0000000007770000-0x000000000777A000-memory.dmp

    Filesize

    40KB

  • memory/3916-6-0x0000000008770000-0x0000000008D88000-memory.dmp

    Filesize

    6.1MB

  • memory/3916-7-0x0000000007A60000-0x0000000007B6A000-memory.dmp

    Filesize

    1.0MB

  • memory/3916-8-0x0000000007950000-0x0000000007962000-memory.dmp

    Filesize

    72KB

  • memory/3916-9-0x00000000079B0000-0x00000000079EC000-memory.dmp

    Filesize

    240KB

  • memory/3916-10-0x00000000079F0000-0x0000000007A3C000-memory.dmp

    Filesize

    304KB

  • memory/3916-11-0x0000000008260000-0x00000000082C6000-memory.dmp

    Filesize

    408KB

  • memory/3916-12-0x0000000009040000-0x0000000009090000-memory.dmp

    Filesize

    320KB

  • memory/3916-13-0x000000000A0B0000-0x000000000A272000-memory.dmp

    Filesize

    1.8MB

  • memory/3916-14-0x000000000A7B0000-0x000000000ACDC000-memory.dmp

    Filesize

    5.2MB

  • memory/3916-16-0x0000000074430000-0x0000000074BE0000-memory.dmp

    Filesize

    7.7MB