Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 21:20

General

  • Target

    33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe

  • Size

    665KB

  • MD5

    1f045515293b36f34c83928c43cdbd13

  • SHA1

    1def80cb8549f24f4687e6b6a9a4fe9311f02f0a

  • SHA256

    33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36

  • SHA512

    1cc4e59aea3344bcae41f522dc56b3a045841bae457311010ca0e9e02b4bedd0492a268f8313ec25cfb4cb7a13c8b674fb1eb0b392579252307f82eee79a5218

  • SSDEEP

    12288:SMrhy90Xd+V5/DicSRFPkjq9zj4v5qbZn4TdxLMse+L8TD+MD4:HyNVTSARvYNnQXeUjM8

Malware Config

Extracted

Family

redline

Botnet

romik

C2

193.233.20.12:4132

Attributes
  • auth_value

    8fb78d2889ba0ca42678b59b884e88ff

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe
    "C:\Users\Admin\AppData\Local\Temp\33df9dacdf9fa1bf8ac66aca2abc3e98bff6fe72dcc71b2db40921c5401d7e36.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhJ61.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhJ61.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4688
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsd85.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsd85.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2028

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhJ61.exe

    Filesize

    520KB

    MD5

    cf7645fd5aacbddc2aaa6298c38ab0a0

    SHA1

    87f1a1948d352b5fbef67c6c0bb51a95e435ac70

    SHA256

    4a3208f4e444451187d72ef973e9389cba39dd3f79ea0163952945795093ff05

    SHA512

    aec3ff7da3f3ee3ad5206ab4b09e0dbd1ff60a43640e5ead2d776ad3f08aac77baefc1da1f6fb8936b4e29f9c8e366ad75956dcf2fc32a76937b49f601bd2c74

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsd85.exe

    Filesize

    305KB

    MD5

    2912e4ea81ea3271b0533d672791b1ad

    SHA1

    b5ef6b062c57da9614baf0faa3270eb6778a940c

    SHA256

    171384e592b4da9bac78fbcb0feb4d46de8e302c960ed3464a399bb3c023253c

    SHA512

    65be335994bb6bb1bb636001afcefd0d3a1052ef4e863f0613a0ba352e6af62dc469d09cdfc3a559e8e6a2cbebf92cc74cc11b5f39c1cb19cec82f6c77b859a2

  • memory/2028-15-0x00000000006E0000-0x00000000007E0000-memory.dmp

    Filesize

    1024KB

  • memory/2028-16-0x0000000000660000-0x00000000006AB000-memory.dmp

    Filesize

    300KB

  • memory/2028-17-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/2028-18-0x0000000000400000-0x000000000057D000-memory.dmp

    Filesize

    1.5MB

  • memory/2028-19-0x0000000002530000-0x0000000002576000-memory.dmp

    Filesize

    280KB

  • memory/2028-20-0x0000000004C90000-0x0000000005234000-memory.dmp

    Filesize

    5.6MB

  • memory/2028-21-0x0000000002630000-0x0000000002674000-memory.dmp

    Filesize

    272KB

  • memory/2028-23-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-29-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-85-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-83-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-81-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-79-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-77-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-75-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-73-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-69-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-67-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-65-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-61-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-59-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-57-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-55-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-53-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-51-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-49-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-47-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-43-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-41-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-39-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-37-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-35-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-33-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-31-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-27-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-25-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-71-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-63-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-45-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-22-0x0000000002630000-0x000000000266E000-memory.dmp

    Filesize

    248KB

  • memory/2028-928-0x0000000005340000-0x0000000005958000-memory.dmp

    Filesize

    6.1MB

  • memory/2028-929-0x0000000005990000-0x0000000005A9A000-memory.dmp

    Filesize

    1.0MB

  • memory/2028-930-0x00000000006E0000-0x00000000007E0000-memory.dmp

    Filesize

    1024KB

  • memory/2028-931-0x0000000005AD0000-0x0000000005AE2000-memory.dmp

    Filesize

    72KB

  • memory/2028-932-0x0000000005AF0000-0x0000000005B2C000-memory.dmp

    Filesize

    240KB

  • memory/2028-933-0x0000000005C40000-0x0000000005C8C000-memory.dmp

    Filesize

    304KB

  • memory/2028-934-0x0000000000660000-0x00000000006AB000-memory.dmp

    Filesize

    300KB

  • memory/2028-936-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB