Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    30/05/2024, 23:05

General

  • Target

    7090723b5821d015e801d537ad745b7de3046ade870b4fd7a3ee8a5ad7d16a46.exe

  • Size

    5.0MB

  • MD5

    004baadff1a627a2f86e6a8345233037

  • SHA1

    9447e67628b6e61adf1f21ad4169481b822d54fe

  • SHA256

    7090723b5821d015e801d537ad745b7de3046ade870b4fd7a3ee8a5ad7d16a46

  • SHA512

    20b437eab89aaccba30c687b254a2ab3834cd78f774b794cf54ac6cae33f3c95a7a793a3f87beb20968e31b23cff711ceab5a6cd1923875380e53512fb9c581e

  • SSDEEP

    98304:a3Txn5/Y05WHbdPn+eT4Om2pZ90XYis5VfIcm:azg05WHbdmPeZ90XYis5V0

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

5.42.65.129:2353

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7090723b5821d015e801d537ad745b7de3046ade870b4fd7a3ee8a5ad7d16a46.exe
    "C:\Users\Admin\AppData\Local\Temp\7090723b5821d015e801d537ad745b7de3046ade870b4fd7a3ee8a5ad7d16a46.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1636-34-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-48-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-2-0x0000000004B50000-0x0000000004C34000-memory.dmp

    Filesize

    912KB

  • memory/1636-4-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-3-0x00000000005F0000-0x000000000060C000-memory.dmp

    Filesize

    112KB

  • memory/1636-5-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-6-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-22-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-64-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-62-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-60-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-58-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-54-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-52-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-50-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-32-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-46-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-44-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-42-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-40-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-38-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-36-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-1-0x0000000000CC0000-0x00000000011C4000-memory.dmp

    Filesize

    5.0MB

  • memory/1636-0-0x000000007464E000-0x000000007464F000-memory.dmp

    Filesize

    4KB

  • memory/1636-76-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-28-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-26-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-24-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-20-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-18-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-16-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-14-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-12-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-10-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-8-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-56-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/1636-65-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/1636-30-0x00000000005F0000-0x0000000000605000-memory.dmp

    Filesize

    84KB

  • memory/2624-68-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2624-77-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2624-78-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2624-69-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2624-67-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2624-66-0x0000000000400000-0x0000000000450000-memory.dmp

    Filesize

    320KB

  • memory/2624-79-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2624-80-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB