Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    8s
  • max time network
    88s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/01/2024, 19:56

General

  • Target

    mystify.exe

  • Size

    618KB

  • MD5

    56310a2d2f98a4fe082b8ab1df7715cd

  • SHA1

    19f5b8fc34cec9738667ba76c539dfaa17a0a2df

  • SHA256

    4d49c61647576d71405df122d55a461940ae46c11da96380ba1c6e5e042060bf

  • SHA512

    144f407b492653c0bb1bc3d13ce0376d21115cd6e70a244e6451256374c500d50ffe53e1cf326a4ccd5e727e538fc11ece46eb9f8363e8a5b2a80743db553c33

  • SSDEEP

    12288:jspCMScwWKnIlhIrtXzEwo+GSUnxp4qh9+CkqcQOH:jsLSrnIlhUtXzEwi9+nQOH

Malware Config

Extracted

Family

redline

Botnet

@mayotiqq

C2

45.15.156.167:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mystify.exe
    "C:\Users\Admin\AppData\Local\Temp\mystify.exe"
    1⤵
      PID:4480

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4480-0-0x0000000000A20000-0x0000000000A72000-memory.dmp

      Filesize

      328KB

    • memory/4480-4-0x0000000074980000-0x0000000075130000-memory.dmp

      Filesize

      7.7MB

    • memory/4480-5-0x00000000057E0000-0x0000000005D84000-memory.dmp

      Filesize

      5.6MB

    • memory/4480-6-0x0000000005180000-0x0000000005212000-memory.dmp

      Filesize

      584KB

    • memory/4480-7-0x00000000052A0000-0x00000000052B0000-memory.dmp

      Filesize

      64KB

    • memory/4480-8-0x0000000005250000-0x000000000525A000-memory.dmp

      Filesize

      40KB

    • memory/4480-9-0x00000000066B0000-0x0000000006CC8000-memory.dmp

      Filesize

      6.1MB

    • memory/4480-11-0x0000000007F30000-0x0000000007F42000-memory.dmp

      Filesize

      72KB

    • memory/4480-13-0x0000000007FE0000-0x000000000802C000-memory.dmp

      Filesize

      304KB

    • memory/4480-12-0x0000000007F90000-0x0000000007FCC000-memory.dmp

      Filesize

      240KB

    • memory/4480-10-0x0000000008040000-0x000000000814A000-memory.dmp

      Filesize

      1.0MB

    • memory/4480-14-0x0000000008F80000-0x0000000008FE6000-memory.dmp

      Filesize

      408KB

    • memory/4480-15-0x000000000A2B0000-0x000000000A472000-memory.dmp

      Filesize

      1.8MB

    • memory/4480-16-0x000000000A9B0000-0x000000000AEDC000-memory.dmp

      Filesize

      5.2MB

    • memory/4480-17-0x0000000009530000-0x0000000009580000-memory.dmp

      Filesize

      320KB

    • memory/4480-18-0x0000000074980000-0x0000000075130000-memory.dmp

      Filesize

      7.7MB

    • memory/4480-19-0x00000000052A0000-0x00000000052B0000-memory.dmp

      Filesize

      64KB