Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
31s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d3d9.dll
Resource
win10v2004-20240709-en
7 signatures
30 seconds
General
-
Target
d3d9.dll
-
Size
436KB
-
MD5
03b5bbf02fdd03c31f004e05ac095912
-
SHA1
b5e5992080cf5667fe35415c34610a7e1188f18e
-
SHA256
a9ccd777bcefff67f3c97d107d7b7a297f55fbbdaf03391ed7a2a4fca946dfdf
-
SHA512
5cdd684f9634cc05ef66957bf8e0a2c3feb6d0b1f922b6bbb29349c93e6271099f95229a8dae255c2ee162d3af683bbb2bd1f4dac657de5671feb9767de8a964
-
SSDEEP
6144:4be7CDMBDPLBuvbR/bXnqkdeVu96XoGS2OWSTCQ6Wm+dLSkzdgtTVgE:46uw9Evb9qkMVu9jGS8STIUBITD
Score
10/10
Malware Config
Extracted
Family
redline
C2
185.196.9.26:6302
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/3292-1-0x0000000000570000-0x00000000005C0000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4988 set thread context of 3292 4988 rundll32.exe 85 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3292 MSBuild.exe 3292 MSBuild.exe 3292 MSBuild.exe 3292 MSBuild.exe 3292 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3292 MSBuild.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2072 wrote to memory of 4988 2072 rundll32.exe 83 PID 2072 wrote to memory of 4988 2072 rundll32.exe 83 PID 2072 wrote to memory of 4988 2072 rundll32.exe 83 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85 PID 4988 wrote to memory of 3292 4988 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d9.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3d9.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3292
-
-