Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 04:52

General

  • Target

    cd26d1159f20d37cca1aa22af82cf6a3.exe

  • Size

    309KB

  • MD5

    cd26d1159f20d37cca1aa22af82cf6a3

  • SHA1

    f24612e9ae118b4a885c3983022d33da0009a70a

  • SHA256

    5d7e056cab62d45da796272f782b92fdba8c38827e678fa1273c0ccb71aa6d83

  • SHA512

    171da49fd4d34e07bd50c46f27b08d1fb96f4d65706fee68ac76c7ab068c89cefa0a97034b4d8a2bc326174ead329a009ad94993d782e2bf5e3e291f7a32d515

  • SSDEEP

    6144:KhLDRPVxtbyDT9B70uWaHfwkLhpgsgFVg8FY6xA:Khvdt+70u/H5S4

Malware Config

Extracted

Family

redline

Botnet

zaliv

C2

185.244.216.219:33828

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd26d1159f20d37cca1aa22af82cf6a3.exe
    "C:\Users\Admin\AppData\Local\Temp\cd26d1159f20d37cca1aa22af82cf6a3.exe"
    1⤵
      PID:1624

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1624-1-0x0000000001F20000-0x0000000002020000-memory.dmp

      Filesize

      1024KB

    • memory/1624-2-0x00000000039C0000-0x00000000039F0000-memory.dmp

      Filesize

      192KB

    • memory/1624-3-0x0000000003D10000-0x0000000003D36000-memory.dmp

      Filesize

      152KB

    • memory/1624-4-0x0000000000400000-0x0000000001D9B000-memory.dmp

      Filesize

      25.6MB

    • memory/1624-5-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB

    • memory/1624-6-0x00000000063A0000-0x0000000006944000-memory.dmp

      Filesize

      5.6MB

    • memory/1624-7-0x0000000003EE0000-0x0000000003F04000-memory.dmp

      Filesize

      144KB

    • memory/1624-8-0x0000000074D60000-0x0000000075510000-memory.dmp

      Filesize

      7.7MB

    • memory/1624-9-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB

    • memory/1624-10-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB

    • memory/1624-11-0x0000000006950000-0x0000000006F68000-memory.dmp

      Filesize

      6.1MB

    • memory/1624-12-0x0000000006FD0000-0x0000000006FE2000-memory.dmp

      Filesize

      72KB

    • memory/1624-13-0x0000000006FF0000-0x00000000070FA000-memory.dmp

      Filesize

      1.0MB

    • memory/1624-14-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB

    • memory/1624-15-0x0000000007100000-0x000000000713C000-memory.dmp

      Filesize

      240KB

    • memory/1624-16-0x0000000007180000-0x00000000071CC000-memory.dmp

      Filesize

      304KB

    • memory/1624-17-0x0000000000400000-0x0000000001D9B000-memory.dmp

      Filesize

      25.6MB

    • memory/1624-19-0x0000000001F20000-0x0000000002020000-memory.dmp

      Filesize

      1024KB

    • memory/1624-20-0x00000000039C0000-0x00000000039F0000-memory.dmp

      Filesize

      192KB

    • memory/1624-21-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB

    • memory/1624-22-0x0000000074D60000-0x0000000075510000-memory.dmp

      Filesize

      7.7MB

    • memory/1624-23-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB

    • memory/1624-25-0x0000000003F30000-0x0000000003F40000-memory.dmp

      Filesize

      64KB