Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

8bc13105f1...ba.exe

windows7-x64

10

8bc13105f1...ba.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 02:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe

  • Size

    176KB

  • MD5

    4492c25f21b82d16ad5394c2b596ceb0

  • SHA1

    6094ac1b1f6adbc284c3d6ac271815917fdd802d

  • SHA256

    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba

  • SHA512

    8710295523505b0a1865a430a4669cfe9e41a1bf7f25e4956f7c6cfcf72dcd1a78f1312fe63df250a3754b712a0b4231da09b03045b92ef59f58a8b657a9b37b

  • SSDEEP

    3072:6xqZWBJaHEDgXTzzfMK8emA9Xh8fxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOB:oqZVTPfBbXhA

Score
10/10
redlinedunkandiscoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

dunkan

C2

193.233.20.24:4123

Attributes
  • auth_value

    505c396c57c6287fc3fdc5f3aeab0819

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe
    "C:\Users\Admin\AppData\Local\Temp\8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3796

Network

  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    105.208.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    105.208.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    98.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    98.117.19.2.in-addr.arpa
    IN PTR
    Response
    98.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-98deploystaticakamaitechnologiescom
  • flag-us
    DNS
    72.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • 193.233.20.24:4123
    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe
    260 B
     5
  • 193.233.20.24:4123
    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe
    260 B
     5
  • 193.233.20.24:4123
    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe
    260 B
     5
  • 193.233.20.24:4123
    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe
    260 B
     5
  • 193.233.20.24:4123
    8bc13105f106f40def4d4e2b70ff9ea9ae7b866a5daeb216b096b9bea1fa25ba.exe
    208 B
     4
  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    105.208.201.84.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    105.208.201.84.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    71.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    71.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    98.117.19.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    98.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    72.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    72.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3796-0-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3796-1-0x00000000006F0000-0x0000000000722000-memory.dmp

    Filesize

    200KB

    Download

  • memory/3796-2-0x0000000005550000-0x0000000005B68000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3796-3-0x0000000005080000-0x000000000518A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3796-4-0x0000000004FC0000-0x0000000004FD2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3796-5-0x0000000005020000-0x000000000505C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3796-6-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3796-7-0x0000000005190000-0x00000000051DC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3796-8-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3796-9-0x0000000074FE0000-0x0000000075790000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.