Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 22:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1edb006d81c0fe2a2c0076545664381e.exe
Resource
win7-20231215-en
6 signatures
150 seconds
General
-
Target
1edb006d81c0fe2a2c0076545664381e.exe
-
Size
590KB
-
MD5
1edb006d81c0fe2a2c0076545664381e
-
SHA1
422cfe5a0074a1471c5e9a756594113cd3ba1941
-
SHA256
6abea903bfed788913dfbb674c1c2f52fa945247c28fa9fce9be3bec8c6cd3e3
-
SHA512
bbf3b11ac17c0b6bfadb8cc85600f45f120080d1090c7c664106a59315f4952dbb50595207d6d0eb0c50862897f97b3cf9c4f9262a6826125cf546430bb9f342
-
SSDEEP
12288:d4/Xq6vRC7ittHAWtv4UQkFMjEEWpx3F5yfH:qrG0
Malware Config
Extracted
Family
redline
Botnet
111
C2
194.113.106.16:26755
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3656-6-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SectopRAT payload 1 IoCs
resource yara_rule behavioral2/memory/3656-6-0x0000000000400000-0x0000000000420000-memory.dmp family_sectoprat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2492 set thread context of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2492 wrote to memory of 912 2492 1edb006d81c0fe2a2c0076545664381e.exe 73 PID 2492 wrote to memory of 912 2492 1edb006d81c0fe2a2c0076545664381e.exe 73 PID 2492 wrote to memory of 912 2492 1edb006d81c0fe2a2c0076545664381e.exe 73 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95 PID 2492 wrote to memory of 3656 2492 1edb006d81c0fe2a2c0076545664381e.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe"C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exeC:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe2⤵PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exeC:\Users\Admin\AppData\Local\Temp\1edb006d81c0fe2a2c0076545664381e.exe2⤵PID:3656
-