Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2024, 13:44

General

  • Target

    1c5a394abb707ca7e0eef2303c5ea106509110062772768542b6d236c41cd9d0.exe

  • Size

    371KB

  • MD5

    f18e56946d40fd07f5d70f9b291635c0

  • SHA1

    e5fb925736a78c5cbdf0b2c85fcb8eda2c9a036b

  • SHA256

    1c5a394abb707ca7e0eef2303c5ea106509110062772768542b6d236c41cd9d0

  • SHA512

    3322a5ac5cecabd6d87fb7f8bf9f2798b70f5bac844cb778423d52a68ddc0caf7c1d27c615da9a687d87bf61831b3a7c7f0db7aea61a504cf84fe09787f5a61f

  • SSDEEP

    6144:OrQh7mH2qa6nCwx1nzk/daKaihR1osZ/8/UQ51C/b7ITsqXigaXwVfZ:OrQh7mH2p6nCI1nw6cR1OUQmj7R

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1c5a394abb707ca7e0eef2303c5ea106509110062772768542b6d236c41cd9d0.exe
    "C:\Users\Admin\AppData\Local\Temp\1c5a394abb707ca7e0eef2303c5ea106509110062772768542b6d236c41cd9d0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4100

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4100-0-0x0000000004900000-0x000000000492B000-memory.dmp

    Filesize

    172KB

  • memory/4100-1-0x0000000004930000-0x0000000004969000-memory.dmp

    Filesize

    228KB

  • memory/4100-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/4100-3-0x0000000004AF0000-0x0000000004B24000-memory.dmp

    Filesize

    208KB

  • memory/4100-4-0x0000000007510000-0x0000000007AB4000-memory.dmp

    Filesize

    5.6MB

  • memory/4100-5-0x0000000004E90000-0x0000000004EC2000-memory.dmp

    Filesize

    200KB

  • memory/4100-6-0x0000000000400000-0x0000000002B95000-memory.dmp

    Filesize

    39.6MB

  • memory/4100-58-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-36-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-70-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-68-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-66-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-64-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-62-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-957-0x0000000007AC0000-0x00000000080D8000-memory.dmp

    Filesize

    6.1MB

  • memory/4100-959-0x00000000073E0000-0x00000000074EA000-memory.dmp

    Filesize

    1.0MB

  • memory/4100-958-0x00000000073C0000-0x00000000073D2000-memory.dmp

    Filesize

    72KB

  • memory/4100-60-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-56-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-54-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-53-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-50-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-48-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-46-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-44-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-42-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-40-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-38-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-34-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-32-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-30-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-28-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-26-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-24-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-22-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-20-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-18-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-14-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-12-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-10-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-8-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-7-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-16-0x0000000004E90000-0x0000000004EBC000-memory.dmp

    Filesize

    176KB

  • memory/4100-960-0x00000000080F0000-0x000000000812C000-memory.dmp

    Filesize

    240KB

  • memory/4100-961-0x0000000008160000-0x00000000081AC000-memory.dmp

    Filesize

    304KB

  • memory/4100-962-0x0000000004900000-0x000000000492B000-memory.dmp

    Filesize

    172KB

  • memory/4100-963-0x0000000004930000-0x0000000004969000-memory.dmp

    Filesize

    228KB

  • memory/4100-965-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB