Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2024, 19:53

General

  • Target

    Redwolf.Crypter.exe

  • Size

    2.7MB

  • MD5

    05e029861eabed701354fb9be1531758

  • SHA1

    c5c6a2a5aa45222b089cf7d49e6868b123dec237

  • SHA256

    47186ae4cf99e391580f17ea6549fc05c6a4839f7ce1d2ec7c60f52d0438ba05

  • SHA512

    fb6e5beff29b7d9a3400fe4c8caa79affd88dddf878378bb70f54bcc3a8237f6097ae21cb857a674da919b8706aecab1d625a319ec79ceb53dca27aaeb8f74c6

  • SSDEEP

    49152:MA60A6FIm7P/Go4SkGMITYbNbNWo4kSH3OqtwIjkqXfd+/9AqAanV:aSFhP/GogGMIT4bNJFY3OqtXkqXf0FPb

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Redwolf.Crypter.exe
    "C:\Users\Admin\AppData\Local\Temp\Redwolf.Crypter.exe"
    1⤵
    • Drops file in Drivers directory
    • System Location Discovery: System Language Discovery
    • Enumerates system info in registry
    PID:4080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4080-0-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

    Filesize

    4KB

  • memory/4080-1-0x00000000003B0000-0x0000000000660000-memory.dmp

    Filesize

    2.7MB

  • memory/4080-2-0x00000000056D0000-0x0000000005C74000-memory.dmp

    Filesize

    5.6MB

  • memory/4080-3-0x0000000005040000-0x00000000050D2000-memory.dmp

    Filesize

    584KB

  • memory/4080-5-0x0000000074D80000-0x0000000075530000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-4-0x0000000005100000-0x000000000510A000-memory.dmp

    Filesize

    40KB

  • memory/4080-6-0x0000000005410000-0x0000000005624000-memory.dmp

    Filesize

    2.1MB

  • memory/4080-7-0x0000000008330000-0x00000000083E2000-memory.dmp

    Filesize

    712KB

  • memory/4080-8-0x0000000074D80000-0x0000000075530000-memory.dmp

    Filesize

    7.7MB

  • memory/4080-11-0x0000000074D8E000-0x0000000074D8F000-memory.dmp

    Filesize

    4KB

  • memory/4080-12-0x0000000074D80000-0x0000000075530000-memory.dmp

    Filesize

    7.7MB