Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows11-21h2_x64 -
resource
win11-20240709-en -
resource tags
arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/07/2024, 14:57
Static task
static1
Behavioral task
behavioral1
Sample
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe
Resource
win11-20240709-en
windows11-21h2-x64
7 signatures
150 seconds
General
-
Target
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe
-
Size
734KB
-
MD5
6a4f6cee446f83970715939752a1e625
-
SHA1
3c6653f6c3a09e83589343e72f56e0fcade6a98a
-
SHA256
f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6
-
SHA512
f3891ff77889d8f1dd46c01899b458afd270202877289fdcc4edca6428df61345f2b28ecb5dacc61d9587027f766d2e4d4d9ad0c3ac1bb073a524844217726a0
-
SSDEEP
12288:Jo8PwEOZBYFIN47++sPBfkxkZvWe2davbz8G6rFjcvklx+JrKrUt0fxSfOsmWiCG:JnPwhYFINS++Ukxk0e2U3KZ4w0JCfxWw
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/1516-1-0x0000000000400000-0x0000000000484000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4092 set thread context of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe 1516 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeBackupPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe Token: SeSecurityPrivilege 1516 RegAsm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4596 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 83 PID 4092 wrote to memory of 4596 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 83 PID 4092 wrote to memory of 4596 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 83 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84 PID 4092 wrote to memory of 1516 4092 f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe"C:\Users\Admin\AppData\Local\Temp\f8e37fc295b0933fc3cadcc1eb9e22f2338fc8eb3ed4bc07ee17b552159ddda6.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:4596
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516
-