Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 15:44 UTC

General

  • Target

    42f569feb9d6fc7561953999288ab6241dd8825c1a9ba2e7f268d5f47c612da8.exe

  • Size

    348KB

  • MD5

    e4f8f0a91c597b50889f5cc55394efd0

  • SHA1

    aee0095eda93e3f1ecaf816e77e9031b8a20fd4d

  • SHA256

    42f569feb9d6fc7561953999288ab6241dd8825c1a9ba2e7f268d5f47c612da8

  • SHA512

    6fd704ef7d903b72546e195572876f4122b4953b7088cb1136b565b509c4e22675b48147f9567c36117f097b44ef80d7b5378dc4acc5f7ee3ddfbb79cd8f197a

  • SSDEEP

    6144:R20gvpJjSqh3wn5PCLFGJ5MiFPLCcMRyOB6Bwnvh:U08PjS2Ep3lFlMRPQBcvh

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

C2

149.202.8.114:26642

Attributes
  • auth_value

    3a050df92d0cf082b2cdaf87863616be

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f569feb9d6fc7561953999288ab6241dd8825c1a9ba2e7f268d5f47c612da8.exe
    "C:\Users\Admin\AppData\Local\Temp\42f569feb9d6fc7561953999288ab6241dd8825c1a9ba2e7f268d5f47c612da8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2568-1-0x0000000002520000-0x0000000002620000-memory.dmp

    Filesize

    1024KB

  • memory/2568-2-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2568-3-0x0000000003FE0000-0x0000000004018000-memory.dmp

    Filesize

    224KB

  • memory/2568-4-0x0000000000400000-0x0000000002485000-memory.dmp

    Filesize

    32.5MB

  • memory/2568-5-0x0000000003E60000-0x0000000003E94000-memory.dmp

    Filesize

    208KB

  • memory/2568-6-0x0000000000400000-0x0000000002485000-memory.dmp

    Filesize

    32.5MB

  • memory/2568-7-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.