Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26/12/2023, 01:10
General
-
Target
482ff39ce271dff3ca9f31dce9e504d7.exe
-
Size
395KB
-
MD5
482ff39ce271dff3ca9f31dce9e504d7
-
SHA1
5a0c8ca7eb44e07809064a4bea5f8a158bcaf6c2
-
SHA256
62a050d59c89ba86e7c6904843051bc59c930f2b9b19f0cb95370daf243c9550
-
SHA512
5d69c4f0f8cdddc4a1c51940c3028874bcb72deca490df01be0a82dcb17e32aaa4f188a3f6e842f9193a555a8955cc659ba160f76b3a3c9778f66e4813a8a948
-
SSDEEP
12288:ikyLrgFsA2zL3HveqmASGecu39EyjrO9GXi:GgFsA2zDsGkNEy+6
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
SewPalpadin
C2
185.215.113.114:8887
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\482ff39ce271dff3ca9f31dce9e504d7.exe"C:\Users\Admin\AppData\Local\Temp\482ff39ce271dff3ca9f31dce9e504d7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
188KB
-
Filesize
500KB
-
Filesize
7.7MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
5.6MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
6.1MB
-
Filesize
64KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
1024KB
-
Filesize
500KB
-
Filesize
188KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB