Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3149cd41e04...01.exe
windows10-2004-x64
10224cc5582a...c7.exe
windows10-2004-x64
102489ba0556...26.exe
windows10-2004-x64
1024bb66f25f...0a.exe
windows7-x64
324bb66f25f...0a.exe
windows10-2004-x64
103ec1481872...d9.exe
windows10-2004-x64
10628eb5e58d...90.exe
windows10-2004-x64
106aa8d5d0d6...df.exe
windows10-2004-x64
1077b8709187...06.exe
windows7-x64
377b8709187...06.exe
windows10-2004-x64
1094a701520b...a3.exe
windows10-2004-x64
10d9d3f90c8c...39.exe
windows7-x64
3d9d3f90c8c...39.exe
windows10-2004-x64
10f02b51da6b...9b.exe
windows10-2004-x64
10Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
149cd41e04afd54119c40358aa55b0d0de72a8c1e612ff1d1d4d79ab20ba8a01.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
224cc5582a9ac886fdd93fbf84f5c94ce0cbf206de2d7defc6c50dc8e03974c7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
2489ba0556a2d308110025f336bb741c15538f7a7711d47ebb9765ce58c94026.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
24bb66f25f5846f5ea1f67380d2e9e03d5b0407a21b48ff5b74ad88f86154c0a.exe
Resource
win7-20240215-en
Behavioral task
behavioral5
Sample
24bb66f25f5846f5ea1f67380d2e9e03d5b0407a21b48ff5b74ad88f86154c0a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
3ec1481872e34c0f6b2c41f3f178fb42c073b52fa885bcf975535f131944bbd9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
628eb5e58da922f1ec2c7e11dcd4c6cabba8c691205bf118898876a7c1231c90.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
6aa8d5d0d6b96fe2a165ee46c9e31059a444b4fae6660eee669539f88bf869df.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
77b8709187b6802be16e005b1139331349304c04ecd4e741e8609229f0134806.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
77b8709187b6802be16e005b1139331349304c04ecd4e741e8609229f0134806.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
94a701520b1541ce168a4e497a826d85bec77dc049bdd7de9e4665fd8ccb7fa3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe
Resource
win7-20240508-en
Behavioral task
behavioral13
Sample
d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
f02b51da6b6ee268ba4e404af6561d6ba14b5517acb7a394deaeebb29740329b.exe
Resource
win10v2004-20240226-en
General
-
Target
d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe
-
Size
315KB
-
MD5
cdff25efc7f7e69dc426b36f31b873ed
-
SHA1
339a84e0af5d6442c2b11eea5f802635cbc0c776
-
SHA256
d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439
-
SHA512
f1ca99cbe6e504d5e695ccb31dafc3b8b4e01faaed77d3058163011add4a47159ba4629e98b422145cefbea0dc07216e5c36837545911f800378f636bf700fa3
-
SSDEEP
6144:aH9pI60nbM8uPZy3+8KIDwZuNVXSZmn3qPOYTn/MHBXHS:e9+60nbnujZaMY6pjGHS
Malware Config
Extracted
redline
7001210066
https://pastebin.com/raw/KE5Mft0T
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral13/memory/1328-0-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 34 pastebin.com 39 pastebin.com 44 pastebin.com 45 pastebin.com 9 pastebin.com 10 pastebin.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2476 set thread context of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1328 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1328 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2476 wrote to memory of 1412 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 86 PID 2476 wrote to memory of 1412 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 86 PID 2476 wrote to memory of 1412 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 86 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87 PID 2476 wrote to memory of 1328 2476 d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe"C:\Users\Admin\AppData\Local\Temp\d9d3f90c8cee71d17c70e5d1c7d465726e06b1c7cb5b617fd47d203403a1e439.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:1412
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328
-