Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:38

General

  • Target

    fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6.exe

  • Size

    584KB

  • MD5

    247b757f0ef1ccaa8ee96a23cb55b1a3

  • SHA1

    af36c49f351829591db36f318fdffb084cd47081

  • SHA256

    fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6

  • SHA512

    8f2bbae1bc3147d4c97cf1896bc8fb10b46c99713ce1604d84adc1bb6765de6c3f3ff0b8006a6308b824695901af0f09682da17383cb82999c89ae6ffdba6277

  • SSDEEP

    12288:6Mr9y90fN/ltI0aQEDn4bsWYN3Eqpa1eMMEHdOHbTa3rRf:Tyc8GsNN3EnHHdOHqrRf

Malware Config

Extracted

Family

redline

Botnet

ronur

C2

193.233.20.20:4134

Attributes
  • auth_value

    f88f86755a528d4b25f6f3628c460965

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6.exe
    "C:\Users\Admin\AppData\Local\Temp\fa6f44026e1557d9c632d960f6a17c9d46f9cb549580c18878f185de216171b6.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dlt9158.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dlt9158.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nJr41vD.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nJr41vD.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4180

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dlt9158.exe

    Filesize

    439KB

    MD5

    b4d401beb505bd4151678ba6b67409cf

    SHA1

    aee293a2f1388cf9314d33a27dc764ffe286cd7a

    SHA256

    1a4d0cc8907653827b823375b8a167126ddd0c2e18214d8fa1a3a24e5fe5d2f5

    SHA512

    b84bd06951698b61e32098bcaee269dec64acedadef89ed83aae63389a8dd946dabd1ffd3fd6f46dda6b6ee36093425ef4eb1312186988b91d79ff132702f4cf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\nJr41vD.exe

    Filesize

    313KB

    MD5

    478141159f8781bd6901b5c2ec2a6e2f

    SHA1

    95732efeb6ff886a38cf81cd310f183587222e04

    SHA256

    785755222a312d20469e673184727d6744809e9fadc13ed126a7c8d127f0d6f9

    SHA512

    737611e19589fbb61b48f03a3de7cd205b73764a8b608c94c8f3eaf84afc00ededf30f7fa6dd16a9f0a1e7a60f48a7c78531b39ecb544c3dd9d94d8e978e9da9

  • memory/4180-15-0x0000000000650000-0x0000000000750000-memory.dmp

    Filesize

    1024KB

  • memory/4180-17-0x0000000000400000-0x0000000000584000-memory.dmp

    Filesize

    1.5MB

  • memory/4180-16-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/4180-18-0x0000000000400000-0x0000000000584000-memory.dmp

    Filesize

    1.5MB

  • memory/4180-19-0x0000000004C10000-0x0000000004C56000-memory.dmp

    Filesize

    280KB

  • memory/4180-20-0x0000000004D60000-0x0000000005304000-memory.dmp

    Filesize

    5.6MB

  • memory/4180-21-0x0000000004CA0000-0x0000000004CE4000-memory.dmp

    Filesize

    272KB

  • memory/4180-73-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-77-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-85-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-83-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-81-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-79-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-75-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-71-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-69-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-67-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-65-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-63-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-61-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-59-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-57-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-55-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-53-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-51-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-49-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-47-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-45-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-43-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-41-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-39-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-37-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-35-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-33-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-31-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-29-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-27-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-25-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-23-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-22-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/4180-928-0x0000000005310000-0x0000000005928000-memory.dmp

    Filesize

    6.1MB

  • memory/4180-929-0x00000000059A0000-0x0000000005AAA000-memory.dmp

    Filesize

    1.0MB

  • memory/4180-930-0x0000000005AE0000-0x0000000005AF2000-memory.dmp

    Filesize

    72KB

  • memory/4180-931-0x0000000005B40000-0x0000000005B7C000-memory.dmp

    Filesize

    240KB

  • memory/4180-932-0x0000000005C80000-0x0000000005CCC000-memory.dmp

    Filesize

    304KB

  • memory/4180-933-0x0000000000650000-0x0000000000750000-memory.dmp

    Filesize

    1024KB

  • memory/4180-934-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB