Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/02/2024, 02:56

General

  • Target

    076aa69e48d43c3450abbc553718cbf4.exe

  • Size

    361KB

  • MD5

    076aa69e48d43c3450abbc553718cbf4

  • SHA1

    af60d0ec5e9b88d00b1719ca60d5b37749dee8a2

  • SHA256

    7f384f810f0248e6a09b207423115499f43d5343d5fa7cbc3f985900c10109a0

  • SHA512

    3ac221f9bd665ec9b8c0c94f7fc9d6546783c7f1649258b0eeadc4a10322f9f5d704ae11257b3ed4538f6582d73a7a30ee857a426dcec83b3cf71b15a063920f

  • SSDEEP

    6144:lwmDsjr1IUsfoK+vzQDgnaQi7U8k45q0+/Sdtmef/H7S76hJanHuQMn2q3P8rlxf:qmDsjr1ZJTbI7q4a/S3m070Uchq3PYPF

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

185.147.34.93:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\076aa69e48d43c3450abbc553718cbf4.exe
    "C:\Users\Admin\AppData\Local\Temp\076aa69e48d43c3450abbc553718cbf4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1932
    • C:\Users\Admin\AppData\Local\Temp\076aa69e48d43c3450abbc553718cbf4.exe
      "C:\Users\Admin\AppData\Local\Temp\076aa69e48d43c3450abbc553718cbf4.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2364

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Cab8FF2.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar9043.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • C:\Users\Admin\AppData\Local\Temp\tmp94A2.tmp

    Filesize

    46KB

    MD5

    02d2c46697e3714e49f46b680b9a6b83

    SHA1

    84f98b56d49f01e9b6b76a4e21accf64fd319140

    SHA256

    522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

    SHA512

    60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

  • C:\Users\Admin\AppData\Local\Temp\tmp94C7.tmp

    Filesize

    92KB

    MD5

    c5ab22deca134f4344148b20687651f4

    SHA1

    c36513b27480dc2d134cefb29a44510a00ec988d

    SHA256

    1e9bd8064ca87d8441e2702005ef8df9a3647d5542740737abb8a70be7ec9512

    SHA512

    550f45132525e967d749106b9d3b114d17b066967527bfd5c66613d61b6f3995f87b0f3c09def19eed14b5b757f2501645b5103505d126f1dd66994f50e1257e

  • memory/1932-0-0x0000000000E00000-0x0000000000E60000-memory.dmp

    Filesize

    384KB

  • memory/1932-1-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/1932-3-0x00000000048F0000-0x0000000004930000-memory.dmp

    Filesize

    256KB

  • memory/1932-2-0x0000000000AB0000-0x0000000000AFC000-memory.dmp

    Filesize

    304KB

  • memory/1932-4-0x0000000000610000-0x0000000000618000-memory.dmp

    Filesize

    32KB

  • memory/1932-17-0x0000000074C50000-0x000000007533E000-memory.dmp

    Filesize

    6.9MB

  • memory/2364-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2364-15-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-18-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-20-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-21-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB

  • memory/2364-22-0x0000000000720000-0x0000000000760000-memory.dmp

    Filesize

    256KB

  • memory/2364-11-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-9-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-7-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-5-0x0000000000400000-0x000000000041E000-memory.dmp

    Filesize

    120KB

  • memory/2364-137-0x0000000074560000-0x0000000074C4E000-memory.dmp

    Filesize

    6.9MB