Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe
Resource
win10v2004-20241007-en
General
-
Target
95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe
-
Size
2.1MB
-
MD5
d1433f5b2eada044678af57d87ee31e5
-
SHA1
0493152ee8d18335fa5043be0f80d12331f2ea00
-
SHA256
95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2
-
SHA512
80dcff2d4e4001d8adb4eff0963921e4335c80bde476492996e74762918663bc84627ae9ca73023f75f799143d3101939ce0a599fafa164f9750481e4bb680c2
-
SSDEEP
49152:V5OaOl3UYvrbFueD40EJbAXOUghn/WsAXZ//t:V59Q3UYvrBusTM8OUgNLY
Malware Config
Extracted
redline
LogsDiller Cloud (TG: @logsdillabot)
51.210.137.6:47909
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/4612-19-0x0000000000400000-0x0000000000432000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 2 IoCs
pid Process 976 123.exe 4968 321.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 976 set thread context of 4612 976 123.exe 91 PID 4968 set thread context of 4316 4968 321.exe 95 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1692 976 WerFault.exe 86 1372 4968 WerFault.exe 89 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 123.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 321.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1536 cmd.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 3312 wrote to memory of 976 3312 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe 86 PID 3312 wrote to memory of 976 3312 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe 86 PID 3312 wrote to memory of 976 3312 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe 86 PID 3312 wrote to memory of 4968 3312 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe 89 PID 3312 wrote to memory of 4968 3312 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe 89 PID 3312 wrote to memory of 4968 3312 95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe 89 PID 976 wrote to memory of 4612 976 123.exe 91 PID 976 wrote to memory of 4612 976 123.exe 91 PID 976 wrote to memory of 4612 976 123.exe 91 PID 976 wrote to memory of 4612 976 123.exe 91 PID 976 wrote to memory of 4612 976 123.exe 91 PID 4968 wrote to memory of 4316 4968 321.exe 95 PID 4968 wrote to memory of 4316 4968 321.exe 95 PID 4968 wrote to memory of 4316 4968 321.exe 95 PID 4968 wrote to memory of 4316 4968 321.exe 95 PID 4968 wrote to memory of 4316 4968 321.exe 95 PID 4316 wrote to memory of 1536 4316 vbc.exe 101 PID 4316 wrote to memory of 1536 4316 vbc.exe 101 PID 4316 wrote to memory of 1536 4316 vbc.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe"C:\Users\Admin\AppData\Local\Temp\95702883e883a7fa3f7f20ecf6713b03cd00469644d777b73f36351db97ef3c2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Windows\Temp\123.exe"C:\Windows\Temp\123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4612
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 2403⤵
- Program crash
PID:1692
-
-
-
C:\Windows\Temp\321.exe"C:\Windows\Temp\321.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\bebra.exe4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1536
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 1403⤵
- Program crash
PID:1372
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 976 -ip 9761⤵PID:1648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4968 -ip 49681⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5ae771c1de075bbc19c94c282dd0d700f
SHA101e03ffabc07e03a87e0153e7f0f473a17180d6a
SHA256ed827b19c613303aea51290ec4554626883a89a17c37c6f6707221cf77cf5ed3
SHA5121a8e92df2210089e9ee8a85c259c8fb5ba1806cb8174e73a1fc41a8574fe5a0cc44eafe5ab0c67807ef1362e4d461b4fdbeb1af16d2547289c172d4a4ff5b3a8
-
Filesize
3.4MB
MD5ef82992004a4ecb5d8d938253afce558
SHA1358ff0331fc36fc1871225bc11a5011f72949d7c
SHA25611d2605286141b6f88413e09599d6de68d1ef1f291c73a6198397c5b99baede7
SHA51259f0a00078a6330e1395029e7ede525fdfb086543dbb50f0556f1657bc9f007986703e2f59a0581d91ef4315f370779d06312d052cd8139f439c9d1b8a06247b