Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 16:01
Static task
static1
Behavioral task
behavioral1
Sample
2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe
Resource
win10v2004-20241007-en
General
-
Target
2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe
-
Size
297KB
-
MD5
b00bbd15577559484c6a3ac093ceb3f1
-
SHA1
b5dc8af829f8aa7096a18b244ffbace12adcbbd2
-
SHA256
2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21
-
SHA512
9ece887d50e2076a71962ba969405e4b8e3e2098884e8cacd2c571b2aa5c41c6b03a501fb9a44791f9d52a8ab3046c6344e508a863d7ba7f6202d3e57cc0bdb5
-
SSDEEP
6144:rvHwCMbovQJ2lzmGk2l3u7ZOuc50Cb/7rRSUbHMfG4:rPwCMbovQJ6N3u7ZeR/7Ce
Malware Config
Extracted
redline
1
45.9.20.59:46287
-
auth_value
ec6ada170bcec2e72f0e1f3954547f73
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral2/memory/5028-3-0x0000000004CD0000-0x0000000004D04000-memory.dmp family_redline behavioral2/memory/5028-5-0x00000000072B0000-0x00000000072E2000-memory.dmp family_redline behavioral2/memory/5028-14-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-12-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-10-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-8-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-7-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-62-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-52-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-34-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-30-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-28-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-26-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-24-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-22-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-20-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-18-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-16-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-70-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-68-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-66-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-64-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-60-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-58-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-56-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-54-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-50-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-48-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-46-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-44-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-42-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-40-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-38-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-36-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline behavioral2/memory/5028-32-0x00000000072B0000-0x00000000072DC000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5028 2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe"C:\Users\Admin\AppData\Local\Temp\2f495ec6f9d313f3fe833a785ce250e04e97d0bc654882d963e99b5a34964a21.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5028