Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2024, 22:34
Static task
static1
Behavioral task
behavioral1
Sample
0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe
Resource
win10v2004-20241007-en
General
-
Target
0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe
-
Size
468KB
-
MD5
9e161b1b079ca2f868f48275df796322
-
SHA1
a7017d639e29d81598e8e23edcef01e0878a2995
-
SHA256
0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b
-
SHA512
003f5bd940a08182266a76816aa030e1fa46c6f7e7b7fa8ace855603bd33deb1da0e5e9098eb8a68e19e4c6fa6da0cec5a74e7cefbcb815ed13e22120f84f9ee
-
SSDEEP
12288:2Mr/y90GZxeiAJDk7mKMTsNQeUnqtzXC:1yVeTJDk5MTsieKq4
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b65-12.dat family_redline behavioral1/memory/208-15-0x00000000009F0000-0x0000000000A22000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
pid Process 4768 nlV99.exe 208 bPe79.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nlV99.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlV99.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bPe79.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3144 wrote to memory of 4768 3144 0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe 83 PID 3144 wrote to memory of 4768 3144 0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe 83 PID 3144 wrote to memory of 4768 3144 0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe 83 PID 4768 wrote to memory of 208 4768 nlV99.exe 84 PID 4768 wrote to memory of 208 4768 nlV99.exe 84 PID 4768 wrote to memory of 208 4768 nlV99.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe"C:\Users\Admin\AppData\Local\Temp\0c519d00b713674f2df44a70625746b9bab56dae1ab05af3dbc06c072254dd1b.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nlV99.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nlV99.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bPe79.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bPe79.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:208
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD5b92b3675398e7b235786354106de7244
SHA1dde6287488ce9b14541c8c952d8f451505518b5a
SHA2567055b30312844d0eefdd5167639fce1fc55d14e57f306e8f4b9574d7a4f01197
SHA5123203f5636e1252361331a8fa0bf590cd7edd5b5a2919061d5c4c6f540d34a0a03ebf4c89c071b7d5e6ddb0a8aa823be9469a164835e01b2de7422b86ace87349
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2