Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    24/06/2024, 09:09

General

  • Target

    0876c8cfa6fce7ba925879cf54cfc3e5e8dbd4ab75b8d272ec811181bca1d4df.exe

  • Size

    518KB

  • MD5

    22e12c6584a91ededf0c2b23e681a47f

  • SHA1

    743b67f04991dfd00684c4c7bb0e160091345375

  • SHA256

    0876c8cfa6fce7ba925879cf54cfc3e5e8dbd4ab75b8d272ec811181bca1d4df

  • SHA512

    115acff92308fbc377e719c2896c198e66ffa6bd9384e9ae2444bcfd32037c41c3a580d50c2e03bfda925d2d7fb50816f764c400f0af8e8ade47a07a3c261e36

  • SSDEEP

    12288:Ck76RTey5sJg5/8D+v+va1eF+cRDdtpwQJQmZ:Ck7+Tey5s65kD21xoDN

Malware Config

Extracted

Family

redline

Botnet

drake

C2

83.97.73.131:19071

Attributes
  • auth_value

    74ce6ffe4025a2e4027fb727915e7d7c

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0876c8cfa6fce7ba925879cf54cfc3e5e8dbd4ab75b8d272ec811181bca1d4df.exe
    "C:\Users\Admin\AppData\Local\Temp\0876c8cfa6fce7ba925879cf54cfc3e5e8dbd4ab75b8d272ec811181bca1d4df.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6186277.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6186277.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f6491078.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\f6491078.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2696

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x6186277.exe

    Filesize

    321KB

    MD5

    c7c5a6f94414a5e83180bf41d3f0b5db

    SHA1

    80fdf2bda3260cb10ed6f3df292fb931c0f4cc98

    SHA256

    bc1dcc53d9deb207db4c49e84bac40e2d815b68b22841e63bcfcec7b80947b94

    SHA512

    561d6a999a85539193b3d55bc195b047d76100fed434fd816ecd41fc439e675810aca41affde67028ff46d0224b4b55127c7a907b56953256a3dde9a4f315088

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\f6491078.exe

    Filesize

    269KB

    MD5

    ba3cf7ff2d77ce0b186a0250adf1d127

    SHA1

    e725906d15106c8b129d4cf5570c715785fd5c6d

    SHA256

    335841d26c05ef17a7aa4088858ed45650f881860c99e7f41ffbabbd79145fbf

    SHA512

    c307081cdb317acb62dfa37753f9d8a7d15288f57a8dc3ec44dd849c7dcda587026d5c015fddbd9956dfd7e89585659141bbb17af084316e10c6e7ff6f44f0ab

  • memory/1476-0-0x0000000000401000-0x0000000000403000-memory.dmp

    Filesize

    8KB

  • memory/1476-1-0x00000000002A0000-0x000000000030F000-memory.dmp

    Filesize

    444KB

  • memory/2696-31-0x0000000000250000-0x0000000000280000-memory.dmp

    Filesize

    192KB

  • memory/2696-34-0x0000000000400000-0x0000000000441000-memory.dmp

    Filesize

    260KB

  • memory/2696-35-0x0000000000550000-0x0000000000556000-memory.dmp

    Filesize

    24KB