Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe
-
Size
734KB
-
MD5
6a4f6cee446f83970715939752a1e625
-
SHA1
3c6653f6c3a09e83589343e72f56e0fcade6a98a
-
SHA256
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6
-
SHA512
f3891ff77889d8f1dd46c01899b458afd270202877289fdcc4edca6428df61345f2b28ecb5dacc61d9587027f766d2e4d4d9ad0c3ac1bb073a524844217726a0
-
SSDEEP
12288:Jo8PwEOZBYFIN47++sPBfkxkZvWe2davbz8G6rFjcvklx+JrKrUt0fxSfOsmWiCG:JnPwhYFINS++Ukxk0e2U3KZ4w0JCfxWw
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/3576-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3924 set thread context of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe 3576 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 3576 RegAsm.exe Token: SeBackupPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeBackupPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeBackupPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeBackupPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeBackupPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeBackupPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe Token: SeSecurityPrivilege 3576 RegAsm.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88 PID 3924 wrote to memory of 3576 3924 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe"C:\Users\Admin\AppData\Local\Temp\f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3576
-