Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 15:05
General
-
Target
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe
-
Size
894KB
-
MD5
826eb90d730bf03e39d78daa585364bc
-
SHA1
d139eee9235e1f997ef14f014c7fbc3dd3b36a03
-
SHA256
95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e
-
SHA512
c5e50071603a0f7f8e27098a7272f8fa9d987c6daba1104890afa354f1c2ba506c2476911e306d0bae99772159f2462b3f61e844b608b1e1ea0463df22a33d42
-
SSDEEP
24576:0NA3R5drX/WfwOauc1XayZWtTHOB8nDFQXi7hQHX:V5OfwOg1KyMHOi0i7hQ3
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
193.233.255.84:4284
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
.NET Reactor proctector 35 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"C:\Users\Admin\AppData\Local\Temp\95e3b81574e6cbbd2efa792b1d4aadf9acfd6514e469b1e15eae7988f050cf2e.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\2.exe"C:\Windows\Temp\2.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD51420d30f964eac2c85b2ccfe968eebce
SHA1bdf9a6876578a3e38079c4f8cf5d6c79687ad750
SHA256f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
SHA5126fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8
-
Filesize
2KB
MD5fa67e808c060f9a72cdfbfc2970f6629
SHA1ea15615c11b4afc207b7e7067b12e6515f8be9ca
SHA2561aecab2df6804695de6e87894261bca24f5dd3ac13550d44aa82c2cc79cb40dd
SHA5125ca591307bf1199cf888b631bafebdd860bc34907374dd5b0ccd0176d7d8064b3b27d82f63ce10de7529c7dc1e6117e04627e327cfa0404c6e4d0cb0e924c146
-
Filesize
2KB
MD5433b80c1e71ce547923af4abf81d67da
SHA14949f8a32ff682f34b713acf58ef3a2aeabdaa4d
SHA256616b1abe263f001ba7bf38ab4551954a582a11447ae3202bb34cd54fefcf8a41
SHA512c168527abe1123511fb862526b00df4a0a13fb580b3ad10fff77c56695e7b2ad1d24262b56ff9f9481901ba5915658d111e926e916214fdd8ebf1b6a65aeccc1
-
Filesize
323KB
MD58214daede69a0da8327553bd9f8ae499
SHA1334655ca2474e04b411f064e86d4bbfd3b6b19f8
SHA2560d968172eebfc13e25d0e70b2d476e5711fc2e96604bbcfdfd89c0c157e7a61f
SHA512f8c8fa7344b5e9da9cbc835b71aac984ef6712b52101937074c0908e2bfc8fc01f875484ace40292c542bcb93196cac7267433e2cd5f4444878856b822101d3c
-
Filesize
435KB
MD51f3cfcf8aad3e5e3164405d272aa213e
SHA196f1c646d19deab4ff071fbc6b3c73c87ce56e49
SHA256fcdab9639af874cba780e20c21a9bc662b160dc313ddb75e5f82f779f1680101
SHA5120d2008b613bed0f1bed205ace8e89d13d5b5e0fca924ca1f9d0e322564c7d7610e0e735e3686701d3042fef1c164dcd43e40a67eb60199b885fbcb761fa41b06
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
7.7MB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
448KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
240KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
456KB
-
Filesize
6.1MB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
328KB
-
Filesize
120KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
320KB
-
Filesize
72KB
-
Filesize
1.0MB