Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/11/2024, 01:19
Static task
static1
Behavioral task
behavioral1
Sample
62eb49220dad28ffe753ec1ac5e549da8659b344.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
62eb49220dad28ffe753ec1ac5e549da8659b344.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
62eb49220dad28ffe753ec1ac5e549da8659b344.exe
-
Size
304KB
-
MD5
81a3940dd3621ab40773d20dfb6a01c3
-
SHA1
62eb49220dad28ffe753ec1ac5e549da8659b344
-
SHA256
6864c883260974b6c14e455aa32e9d7ff02fd27f47dd9574fb5e5279116cd859
-
SHA512
8767b7ad8cf744f8c5dca5ab9b3648dc22043d68066627e23a4407b458387bd5e3b0022a428f97431c025e7a54540ce51a388e4adde098ed8947614c9fe0fd13
-
SSDEEP
6144:eqhMz7iEt7kdq/B0QUnWeXAOwT4DZ/N4ZNPuGyLY4QGh86f:NhMz7iERv1UbX7dN+0GZ4QGhlf
Malware Config
Extracted
Family
redline
Botnet
REDLINEVIP (TG: @Fatherofcarders) 150K
C2
178.32.215.163:17189
Attributes
-
auth_value
0f7b7a0ecd1083169a37fc5d6e242919
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/memory/1548-9-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1548-2-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1548-10-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Redline family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3048 set thread context of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe Token: SeLoadDriverPrivilege 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31 PID 3048 wrote to memory of 1548 3048 62eb49220dad28ffe753ec1ac5e549da8659b344.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\62eb49220dad28ffe753ec1ac5e549da8659b344.exe"C:\Users\Admin\AppData\Local\Temp\62eb49220dad28ffe753ec1ac5e549da8659b344.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1548
-