Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/11/2024, 01:38
General
-
Target
fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6.exe
-
Size
584KB
-
MD5
247b757f0ef1ccaa8ee96a23cb55b1a3
-
SHA1
af36c49f351829591db36f318fdffb084cd47081
-
SHA256
fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6
-
SHA512
8f2bbae1bc3147d4c97cf1896bc8fb10b46c99713ce1604d84adc1bb6765de6c3f3ff0b8006a6308b824695901af0f09682da17383cb82999c89ae6ffdba6277
-
SSDEEP
12288:6Mr9y90fN/ltI0aQEDn4bsWYN3Eqpa1eMMEHdOHbTa3rRf:Tyc8GsNN3EnHHdOHqrRf
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6.exe"C:\Users\Admin\AppData\Local\Temp\fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dlt9158.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dlt9158.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nJr41vD.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nJr41vD.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439KB
MD5b4d401beb505bd4151678ba6b67409cf
SHA1aee293a2f1388cf9314d33a27dc764ffe286cd7a
SHA2561a4d0cc8907653827b823375b8a167126ddd0c2e18214d8fa1a3a24e5fe5d2f5
SHA512b84bd06951698b61e32098bcaee269dec64acedadef89ed83aae63389a8dd946dabd1ffd3fd6f46dda6b6ee36093425ef4eb1312186988b91d79ff132702f4cf
-
Filesize
313KB
MD5478141159f8781bd6901b5c2ec2a6e2f
SHA195732efeb6ff886a38cf81cd310f183587222e04
SHA256785755222a312d20469e673184727d6744809e9fadc13ed126a7c8d127f0d6f9
SHA512737611e19589fbb61b48f03a3de7cd205b73764a8b608c94c8f3eaf84afc00ededf30f7fa6dd16a9f0a1e7a60f48a7c78531b39ecb544c3dd9d94d8e978e9da9
-
Filesize
1024KB
-
Filesize
1.5MB
-
Filesize
312KB
-
Filesize
1.5MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
312KB