Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    166s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30/12/2023, 22:51

General

  • Target

    1f087215932979f2ee843abc4ba51d10.exe

  • Size

    1.3MB

  • MD5

    1f087215932979f2ee843abc4ba51d10

  • SHA1

    c4b5b07b0bc22485f630fae62c8bf9f079de84ec

  • SHA256

    f9d998739161423a8e526158d540bf631f31590ae34d52789d44bf365a7a3f54

  • SHA512

    099dd2dd7a0e03cf91d9948fe5b92c01d790de60b54a6fd01ac98a7642741f91d1385fafd73fc4bccd6ea1a309435536a0221c61403db2cb3bd916086f39eab5

  • SSDEEP

    12288:DmM4E0htYa98ETR8eSa0NV/2zDwLpA5ApAu3OZP7Caok/LCF0m:DNY

Malware Config

Extracted

Family

redline

Botnet

@trizzych

C2

ierinapu.xyz:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1f087215932979f2ee843abc4ba51d10.exe
    "C:\Users\Admin\AppData\Local\Temp\1f087215932979f2ee843abc4ba51d10.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1248
    • C:\Users\Admin\AppData\Local\Temp\1f087215932979f2ee843abc4ba51d10.exe
      C:\Users\Admin\AppData\Local\Temp\1f087215932979f2ee843abc4ba51d10.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1248-0-0x00000000012E0000-0x0000000001344000-memory.dmp

    Filesize

    400KB

  • memory/1248-1-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/1248-2-0x0000000000650000-0x0000000000690000-memory.dmp

    Filesize

    256KB

  • memory/1248-15-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2324-13-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-9-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-4-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-11-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2324-14-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB

  • memory/2324-6-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-3-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-5-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2324-16-0x0000000000AE0000-0x0000000000B20000-memory.dmp

    Filesize

    256KB

  • memory/2324-17-0x0000000074490000-0x0000000074B7E000-memory.dmp

    Filesize

    6.9MB