Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1edb006d81c0fe2a2c0076545664381e.exe
Resource
win7-20231215-en
6 signatures
150 seconds
General
-
Target
1edb006d81c0fe2a2c0076545664381e.exe
-
Size
590KB
-
MD5
1edb006d81c0fe2a2c0076545664381e
-
SHA1
422cfe5a0074a1471c5e9a756594113cd3ba1941
-
SHA256
6abea903bfed788913dfbb674c1c2f52fa945247c28fa9fce9be3bec8c6cd3e3
-
SHA512
bbf3b11ac17c0b6bfadb8cc85600f45f120080d1090c7c664106a59315f4952dbb50595207d6d0eb0c50862897f97b3cf9c4f9262a6826125cf546430bb9f342
-
SSDEEP
12288:d4/Xq6vRC7ittHAWtv4UQkFMjEEWpx3F5yfH:qrG0
Malware Config
Extracted
Family
redline
Botnet
111
C2
194.113.106.16:26755
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2248-11-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2248-15-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2248-13-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2248-8-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2248-7-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2248-11-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat behavioral1/memory/2248-15-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat behavioral1/memory/2248-13-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat behavioral1/memory/2248-8-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat behavioral1/memory/2248-7-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1972 set thread context of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29 PID 1972 wrote to memory of 2248 1972 1edb006d81c0fe2a2c0076545664381e.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe"C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exeC:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe2⤵PID:2248
-