Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe
Resource
win10v2004-20240709-en
General
-
Target
92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe
-
Size
765KB
-
MD5
9b27531814c84d9891474794ba3f880f
-
SHA1
13c2fe6e1189d6f5ffac8d67ab6c9c6f2ea61a99
-
SHA256
92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f
-
SHA512
53034ff4716d2a29fa4cde440d29741c09a8f5493c5bcf0564e01921afd1344bf24c53fb97ecb3fabb215be69c3ea7b98a565c24b8f237d2069159666fc1906d
-
SSDEEP
12288:qWgLNqLMg5tqimUsu8l5hs4PShE9EZnuKFqik7/6VVu+mAd7MxlN9+53TL3ibr:fgLNqLMJimUsu8lw4PShgOuKFqizPdI5
Malware Config
Extracted
redline
6951125327
https://t.me/+7Lir0e4Gw381MDhi*https://steamcommunity.com/profiles/76561199038841443
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/444-1-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 740 set thread context of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe 444 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 444 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84 PID 740 wrote to memory of 444 740 92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe"C:\Users\Admin\AppData\Local\Temp\92682078977a588ba4cc3dfe7ce9d744bf752a635ab73c027cdbae68ff8e749f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:444
-