Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
216s -
max time network
218s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
21/07/2024, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
669bd79ba7b76_crypted.exe
Resource
win10-20240404-en
redlinelogsdiller cloud (tg: @logsdillabot)discoveryinfostealerpersistenceprivilege_escalationspywarestealer
windows10-1703-x64
18 signatures
300 seconds
Errors
Reason
Machine shutdown
General
-
Target
669bd79ba7b76_crypted.exe
-
Size
1.2MB
-
MD5
ea997020dfe8911e85a57e22185a827a
-
SHA1
8435195f9077b4759f61d7d5274622342152cd4c
-
SHA256
96db11589e31f55a3bb06de8f13246d3220a483e5ff41f8fabbb1070e0bf52fa
-
SHA512
79d46fd08c7c2ac46eac4a1f5c000cac59421817219ad48c4b9dbb539310c3ee5ac7134ca49ea994b110671a0eca91a7f87582f1765ad2bc0a699e7addcc973b
-
SSDEEP
24576:xscfqYRgWHOpTqaQBm6i65noMaDCLAyPsmGgivF18G6xDWmuZRCt:xaWHOpTqaQBrd57KgLsmSvf8GyWmuZ4
Malware Config
Extracted
Family
redline
Botnet
LogsDiller Cloud (TG: @logsdillabot)
C2
77.105.135.107:3445
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/4188-2-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1460 set thread context of 4188 1460 669bd79ba7b76_crypted.exe 74 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh regedit.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh regedit.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Runs regedit.exe 1 IoCs
pid Process 360 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4188 RegAsm.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4188 RegAsm.exe 4188 RegAsm.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 360 regedit.exe 4456 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4456 taskmgr.exe Token: SeSystemProfilePrivilege 4456 taskmgr.exe Token: SeCreateGlobalPrivilege 4456 taskmgr.exe Token: SeDebugPrivilege 4188 RegAsm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe 4456 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3564 LogonUI.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74 PID 1460 wrote to memory of 4188 1460 669bd79ba7b76_crypted.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\669bd79ba7b76_crypted.exe"C:\Users\Admin\AppData\Local\Temp\669bd79ba7b76_crypted.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4188
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4456
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe"1⤵
- Event Triggered Execution: Netsh Helper DLL
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
PID:360
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a9a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3564