Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
29/10/2024, 12:19
Static task
static1
Behavioral task
behavioral1
Sample
379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral4
Sample
379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
Resource
win11-20241007-en
General
-
Target
379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
-
Size
442KB
-
MD5
dbc8c65968ed3823a9716478dbd9d49a
-
SHA1
0a63ad61469fa208cef9d6b1d8c3f9de5ad0a899
-
SHA256
379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe
-
SHA512
c44f457f6668bded436acad1b94dfab2bafcceb978aacb1f814e06eb65374a3b5f052a7c05182aa898e4fc12fa8c1743d8229c646e49689e8e2fe39b9e83f412
-
SSDEEP
6144:TmdckoOVAQwglvkNo1cThqGhCV3YDd+DG0XYPfbW7yV1O7TC/d:TmScV4VNo1cTNha3YDd+DG0XYa701Ov
Malware Config
Extracted
redline
1
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral3/memory/1964-5-0x00000000025D0000-0x0000000002604000-memory.dmp family_redline behavioral3/memory/1964-7-0x0000000002600000-0x0000000002632000-memory.dmp family_redline behavioral3/memory/1964-39-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-25-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-17-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-15-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-13-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-11-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-9-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-8-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-57-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-71-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-67-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-65-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-63-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-61-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-55-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-53-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-51-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-49-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-47-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-45-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-43-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-41-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-37-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-35-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-33-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-31-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-29-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-27-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-23-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-21-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-19-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-69-0x0000000002600000-0x000000000262C000-memory.dmp family_redline behavioral3/memory/1964-59-0x0000000002600000-0x000000000262C000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1964 379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe"C:\Users\Admin\AppData\Local\Temp\379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1964