Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10/11/2024, 03:19

General

  • Target

    5c3ff24dc15877fc7cef5c2447d9fb4531039a6b07c25f2748c2bac25ac4891a.exe

  • Size

    298KB

  • MD5

    bdc3b1507781174fdb2f544088c1ba31

  • SHA1

    0661b158ad957231943323905334a1f437c3b165

  • SHA256

    5c3ff24dc15877fc7cef5c2447d9fb4531039a6b07c25f2748c2bac25ac4891a

  • SHA512

    d59cec910673725646ad7831d6970c9dfecc943c9b935f6f38c87a5f92ae799cb86da9c6cdc12b93f8b0e0a200f24d35204ee37af11f27a3c6562e45d9f96d0c

  • SSDEEP

    6144:52ECIjjW+LuLIe0T1eXwp8bXk3X4G1cmL2Gp2eT:5FCIjjW6vTHcmLxAe

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5c3ff24dc15877fc7cef5c2447d9fb4531039a6b07c25f2748c2bac25ac4891a.exe
    "C:\Users\Admin\AppData\Local\Temp\5c3ff24dc15877fc7cef5c2447d9fb4531039a6b07c25f2748c2bac25ac4891a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3048

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3048-1-0x0000000000290000-0x00000000002C9000-memory.dmp

    Filesize

    228KB

  • memory/3048-0-0x00000000001B0000-0x00000000001DB000-memory.dmp

    Filesize

    172KB

  • memory/3048-2-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/3048-3-0x00000000045F0000-0x0000000004624000-memory.dmp

    Filesize

    208KB

  • memory/3048-4-0x00000000047C0000-0x00000000047F2000-memory.dmp

    Filesize

    200KB

  • memory/3048-5-0x0000000000400000-0x0000000002B86000-memory.dmp

    Filesize

    39.5MB

  • memory/3048-13-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-33-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-53-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-69-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-67-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-65-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-63-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-61-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-59-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-57-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-55-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-51-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-49-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-47-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-45-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-43-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-41-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-39-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-37-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-35-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-31-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-29-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-27-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-25-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-23-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-21-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-19-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-17-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-15-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-11-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-9-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-7-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-6-0x00000000047C0000-0x00000000047EC000-memory.dmp

    Filesize

    176KB

  • memory/3048-956-0x00000000001B0000-0x00000000001DB000-memory.dmp

    Filesize

    172KB

  • memory/3048-957-0x0000000000290000-0x00000000002C9000-memory.dmp

    Filesize

    228KB

  • memory/3048-958-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB