Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 11:48
Static task
static1
Behavioral task
behavioral1
Sample
NeonHack v.1.9.1.exe
Resource
win7-20240903-en
General
-
Target
NeonHack v.1.9.1.exe
-
Size
497KB
-
MD5
8eef6d2361a4ba46c76fc7390211ef50
-
SHA1
80d740edde7fffbd05ebaafbcf6d7bb8a02ad016
-
SHA256
8a269b9cb003cde07e1b18b16cc59384343be9a9cb5ab71cb6f82ee5e2cd130b
-
SHA512
95ce5f64b443158c2c5cce1d43431a099257c5d49e52d8a17f178df32c69c143ad0d46c8682cc4ff521639c05fc44bdd0ce414f994087cfd524f9d0d9d021513
-
SSDEEP
6144:e33nzsAF7YrlbTyeaheHhpz85ka+wxdLsb/:OjsAF7YrlbO3hi9wsj
Malware Config
Extracted
redline
3
45.88.107.116:44061
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/2452-10-0x0000000000400000-0x000000000042C000-memory.dmp family_redline behavioral1/memory/2452-7-0x0000000000400000-0x000000000042C000-memory.dmp family_redline behavioral1/memory/2452-6-0x0000000000400000-0x000000000042C000-memory.dmp family_redline behavioral1/memory/2452-15-0x0000000000400000-0x000000000042C000-memory.dmp family_redline behavioral1/memory/2452-13-0x0000000000400000-0x000000000042C000-memory.dmp family_redline -
Redline family
-
SectopRAT payload 5 IoCs
resource yara_rule behavioral1/memory/2452-10-0x0000000000400000-0x000000000042C000-memory.dmp family_sectoprat behavioral1/memory/2452-7-0x0000000000400000-0x000000000042C000-memory.dmp family_sectoprat behavioral1/memory/2452-6-0x0000000000400000-0x000000000042C000-memory.dmp family_sectoprat behavioral1/memory/2452-15-0x0000000000400000-0x000000000042C000-memory.dmp family_sectoprat behavioral1/memory/2452-13-0x0000000000400000-0x000000000042C000-memory.dmp family_sectoprat -
Sectoprat family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 796 set thread context of 2452 796 NeonHack v.1.9.1.exe 28 -
Program crash 1 IoCs
pid pid_target Process procid_target 1616 796 WerFault.exe 27 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NeonHack v.1.9.1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NeonHack v.1.9.1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 796 NeonHack v.1.9.1.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 2452 796 NeonHack v.1.9.1.exe 28 PID 796 wrote to memory of 1616 796 NeonHack v.1.9.1.exe 30 PID 796 wrote to memory of 1616 796 NeonHack v.1.9.1.exe 30 PID 796 wrote to memory of 1616 796 NeonHack v.1.9.1.exe 30 PID 796 wrote to memory of 1616 796 NeonHack v.1.9.1.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\NeonHack v.1.9.1.exe"C:\Users\Admin\AppData\Local\Temp\NeonHack v.1.9.1.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\NeonHack v.1.9.1.exe"C:\Users\Admin\AppData\Local\Temp\NeonHack v.1.9.1.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 6522⤵
- Program crash
PID:1616
-