Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    114s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 01:56

General

  • Target

    6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1fN.exe

  • Size

    435KB

  • MD5

    641409e8e5cba9035c7a6f6afeec3770

  • SHA1

    898a8b533a37eaa46a3359349011ab0c8f9e3734

  • SHA256

    6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1f

  • SHA512

    5559aa7b9bcf5e7587d8336d2f55ea2fe038704800f50c3bc423d5ec8c6ba01886ca109f2f59838f19e8af95e04fa3a80e162fe63faa08c1c22926f2774d7f15

  • SSDEEP

    12288:ZzcQNw0UZSjBf6KytxYz72p0SzctJM0C:XK0UZSjBwaf2p0E2Mf

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Redline family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1fN.exe
    "C:\Users\Admin\AppData\Local\Temp\6ba239ded124b5ea070ecea3aea98db7c8e4ee2260c3f23feaf1fb9dee541a1fN.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:9740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\Temp\1.exe

    Filesize

    168KB

    MD5

    1073b2e7f778788852d3f7bb79929882

    SHA1

    7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

    SHA256

    c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

    SHA512

    90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

  • memory/2792-1-0x00000000006A0000-0x00000000007A0000-memory.dmp

    Filesize

    1024KB

  • memory/2792-3-0x0000000000400000-0x00000000004DC000-memory.dmp

    Filesize

    880KB

  • memory/2792-2-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2792-4-0x0000000000400000-0x00000000004DC000-memory.dmp

    Filesize

    880KB

  • memory/2792-5-0x0000000002300000-0x0000000002366000-memory.dmp

    Filesize

    408KB

  • memory/2792-6-0x0000000004790000-0x00000000047F6000-memory.dmp

    Filesize

    408KB

  • memory/2792-7-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-18-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-46-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-60-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-70-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-68-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-66-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-64-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-62-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-58-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-56-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-54-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-52-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-50-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-48-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-44-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-43-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-40-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-39-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-36-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-34-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-32-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-30-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-28-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-26-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-24-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-22-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-20-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-16-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-14-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-12-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-10-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-8-0x0000000004790000-0x00000000047EF000-memory.dmp

    Filesize

    380KB

  • memory/2792-2087-0x00000000006A0000-0x00000000007A0000-memory.dmp

    Filesize

    1024KB

  • memory/2792-2088-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/2792-2089-0x0000000004EA0000-0x0000000004ED2000-memory.dmp

    Filesize

    200KB

  • memory/2792-2099-0x0000000000400000-0x00000000004DC000-memory.dmp

    Filesize

    880KB

  • memory/2792-2100-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/9740-2101-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/9740-2098-0x0000000000EE0000-0x0000000000F10000-memory.dmp

    Filesize

    192KB

  • memory/9740-2102-0x00000000002F0000-0x00000000002F6000-memory.dmp

    Filesize

    24KB

  • memory/9740-2103-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB

  • memory/9740-2104-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/9740-2105-0x00000000744A0000-0x0000000074B8E000-memory.dmp

    Filesize

    6.9MB