Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 21:20
Static task
static1
Behavioral task
behavioral1
Sample
33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe
Resource
win10v2004-20241007-en
General
-
Target
33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe
-
Size
665KB
-
MD5
1f045515293b36f34c83928c43cdbd13
-
SHA1
1def80cb8549f24f4687e6b6a9a4fe9311f02f0a
-
SHA256
33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36
-
SHA512
1cc4e59aea3344bcae41f522dc56b3a045841bae457311010ca0e9e02b4bedd0492a268f8313ec25cfb4cb7a13c8b674fb1eb0b392579252307f82eee79a5218
-
SSDEEP
12288:SMrhy90Xd+V5/DicSRFPkjq9zj4v5qbZn4TdxLMse+L8TD+MD4:HyNVTSARvYNnQXeUjM8
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2028-19-0x0000000002530000-0x0000000002576000-memory.dmp family_redline behavioral1/memory/2028-21-0x0000000002630000-0x0000000002674000-memory.dmp family_redline behavioral1/memory/2028-23-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-29-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-85-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-83-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-81-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-79-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-77-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-75-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-73-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-69-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-67-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-65-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-61-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-59-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-57-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-55-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-53-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-51-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-49-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-47-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-43-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-41-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-39-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-37-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-35-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-33-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-31-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-27-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-25-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-71-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-63-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-45-0x0000000002630000-0x000000000266E000-memory.dmp family_redline behavioral1/memory/2028-22-0x0000000002630000-0x000000000266E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
pid Process 4688 vhJ61.exe 2028 dsd85.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vhJ61.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dsd85.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhJ61.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2028 dsd85.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4496 wrote to memory of 4688 4496 33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe 83 PID 4496 wrote to memory of 4688 4496 33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe 83 PID 4496 wrote to memory of 4688 4496 33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe 83 PID 4688 wrote to memory of 2028 4688 vhJ61.exe 84 PID 4688 wrote to memory of 2028 4688 vhJ61.exe 84 PID 4688 wrote to memory of 2028 4688 vhJ61.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe"C:\Users\Admin\AppData\Local\Temp\33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhJ61.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhJ61.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsd85.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsd85.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
520KB
MD5cf7645fd5aacbddc2aaa6298c38ab0a0
SHA187f1a1948d352b5fbef67c6c0bb51a95e435ac70
SHA2564a3208f4e444451187d72ef973e9389cba39dd3f79ea0163952945795093ff05
SHA512aec3ff7da3f3ee3ad5206ab4b09e0dbd1ff60a43640e5ead2d776ad3f08aac77baefc1da1f6fb8936b4e29f9c8e366ad75956dcf2fc32a76937b49f601bd2c74
-
Filesize
305KB
MD52912e4ea81ea3271b0533d672791b1ad
SHA1b5ef6b062c57da9614baf0faa3270eb6778a940c
SHA256171384e592b4da9bac78fbcb0feb4d46de8e302c960ed3464a399bb3c023253c
SHA51265be335994bb6bb1bb636001afcefd0d3a1052ef4e863f0613a0ba352e6af62dc469d09cdfc3a559e8e6a2cbebf92cc74cc11b5f39c1cb19cec82f6c77b859a2