Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    24s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/05/2024, 14:26

General

  • Target

    Redline Stealer/RedLine.MainPanel-cracked.exe

  • Size

    633KB

  • MD5

    baf102927947289e4d589028620ce291

  • SHA1

    5ade9a99a86e5558e5353afa7844229ed23bdcd5

  • SHA256

    a6d2d1ba6765e5245b0f62e37d9298e20c913c5a33912b98bd65a76fc5ab28ae

  • SHA512

    973ecb034ba18a74c85165df743d9d87168b07539c8ef1d60550171bc0a5766a10b9e6be1425aea203be45b4175694a489ea1b7837faa3b1927ca019492ccd37

  • SSDEEP

    12288:JhNkz1XpXpXpXpXpXpXpXpXpXpX7t4umBNOuihNynH91xX:J22Mnynd

Score
10/10

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Redline Stealer\RedLine.MainPanel-cracked.exe
    "C:\Users\Admin\AppData\Local\Temp\Redline Stealer\RedLine.MainPanel-cracked.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:5044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5044-0-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/5044-1-0x0000000000300000-0x00000000003A4000-memory.dmp

    Filesize

    656KB

  • memory/5044-2-0x0000000004DA0000-0x0000000004DCA000-memory.dmp

    Filesize

    168KB

  • memory/5044-3-0x0000000004D90000-0x0000000004D9A000-memory.dmp

    Filesize

    40KB

  • memory/5044-4-0x0000000005250000-0x000000000528E000-memory.dmp

    Filesize

    248KB

  • memory/5044-5-0x0000000005220000-0x0000000005232000-memory.dmp

    Filesize

    72KB

  • memory/5044-6-0x0000000005310000-0x0000000005384000-memory.dmp

    Filesize

    464KB

  • memory/5044-7-0x0000000005390000-0x00000000053EA000-memory.dmp

    Filesize

    360KB

  • memory/5044-8-0x0000000005210000-0x0000000005220000-memory.dmp

    Filesize

    64KB

  • memory/5044-9-0x00000000052B0000-0x00000000052CC000-memory.dmp

    Filesize

    112KB

  • memory/5044-10-0x00000000052A0000-0x00000000052AE000-memory.dmp

    Filesize

    56KB

  • memory/5044-11-0x00000000054A0000-0x0000000005550000-memory.dmp

    Filesize

    704KB

  • memory/5044-12-0x0000000005440000-0x000000000548A000-memory.dmp

    Filesize

    296KB

  • memory/5044-13-0x00000000052F0000-0x00000000052FE000-memory.dmp

    Filesize

    56KB

  • memory/5044-14-0x0000000005550000-0x000000000557A000-memory.dmp

    Filesize

    168KB

  • memory/5044-15-0x0000000005800000-0x0000000005AB0000-memory.dmp

    Filesize

    2.7MB

  • memory/5044-16-0x0000000005410000-0x000000000542A000-memory.dmp

    Filesize

    104KB

  • memory/5044-17-0x0000000006060000-0x0000000006606000-memory.dmp

    Filesize

    5.6MB

  • memory/5044-18-0x0000000005630000-0x00000000056C2000-memory.dmp

    Filesize

    584KB

  • memory/5044-19-0x0000000006C30000-0x0000000007248000-memory.dmp

    Filesize

    6.1MB

  • memory/5044-20-0x0000000005700000-0x000000000570A000-memory.dmp

    Filesize

    40KB

  • memory/5044-21-0x00000000744A0000-0x0000000074C51000-memory.dmp

    Filesize

    7.7MB

  • memory/5044-22-0x00000000744A0000-0x0000000074C51000-memory.dmp

    Filesize

    7.7MB

  • memory/5044-23-0x0000000009C20000-0x0000000009C32000-memory.dmp

    Filesize

    72KB

  • memory/5044-24-0x0000000009C80000-0x0000000009CBC000-memory.dmp

    Filesize

    240KB

  • memory/5044-25-0x0000000009E10000-0x0000000009E5C000-memory.dmp

    Filesize

    304KB

  • memory/5044-26-0x000000000A160000-0x000000000A26A000-memory.dmp

    Filesize

    1.0MB

  • memory/5044-28-0x000000000A8D0000-0x000000000A920000-memory.dmp

    Filesize

    320KB

  • memory/5044-27-0x000000000A0B0000-0x000000000A0D8000-memory.dmp

    Filesize

    160KB

  • memory/5044-29-0x00000000744A0000-0x0000000074C51000-memory.dmp

    Filesize

    7.7MB

  • memory/5044-30-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/5044-31-0x00000000744A0000-0x0000000074C51000-memory.dmp

    Filesize

    7.7MB

  • memory/5044-32-0x00000000744A0000-0x0000000074C51000-memory.dmp

    Filesize

    7.7MB