Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 21:07
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240709-en
General
-
Target
Setup.exe
-
Size
20.9MB
-
MD5
912efae7a7d244463759a9aed4414ba4
-
SHA1
2cd8fa91f268d4b2a3e5e0e129fff94e2729f2e6
-
SHA256
67f8c217f33e7393a18bdc4cc3648eb35b1bd3bbed399f5d579c421595addd66
-
SHA512
4ac30c336103328bbdaa010c195beecad66f6e37e29eef9bf837333988726a0b6fa25499436fb197a4bb21302306e6b31758490f24ccbf09f7971c6beabb1b2e
-
SSDEEP
12288:eDZs5ibnV7JdUCEEJPgxzzZ3StDFYggcSPhAT4mmKq/QFeO+j6A2tzwPBQOTWafw:eDKQzV7JeCz4X3i
Malware Config
Extracted
redline
crypt
89.23.101.114:1912
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3552-8-0x0000000000400000-0x0000000000452000-memory.dmp family_redline -
Loads dropped DLL 1 IoCs
pid Process 4884 Setup.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4884 set thread context of 3552 4884 Setup.exe 87 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 3552 MSBuild.exe 3552 MSBuild.exe 3552 MSBuild.exe 3552 MSBuild.exe 3552 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3552 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87 PID 4884 wrote to memory of 3552 4884 Setup.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
440KB
MD5de31e9e70fce48e4ac9ddcd2c8f13402
SHA1d5a1b88332a6f90073b5dac68d9991e02bfb0921
SHA256e61a75e18da19ae29be40df85d3c54b9a08a290521f5ffb62e44d187819ddee0
SHA51223a76c27d39074506aefea6ef4d90f168ad10d1425410db96ff81cd0713e48be024755f949a763dbd199a3e77d494741de9563e4364195d7320a7590bb95f30a