Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12/11/2024, 11:41
General
-
Target
c675099c1e7163239186019285c9d47dce829c2601e639cf9c50fff04e4c5d85N.exe
-
Size
510KB
-
MD5
206a0d4e802a16815331691bf2fffc0c
-
SHA1
5a30039fae13f756aaeeddab44188e27a865b231
-
SHA256
3fea72f95a8702933c3524ce8954476bcbf172375baccb3543f7ad765307260f
-
SHA512
ae533e152f5ab21cd5c4325fbfd8724abf7991f2bb54b3357ae006ee37e75dcb1320ff2289629e8d6a8e0d0d75a9580531d678e5b7b87ce3efedcd0b8310be52
-
SSDEEP
12288:oMray90ax2MZODIBX2m1xgqM1Ck32dQ31E/My:yyz2ME4yB732O31wMy
Malware Config
Extracted
redline
romik
193.233.20.12:4132
-
auth_value
8fb78d2889ba0ca42678b59b884e88ff
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c675099c1e7163239186019285c9d47dce829c2601e639cf9c50fff04e4c5d85N.exe"C:\Users\Admin\AppData\Local\Temp\c675099c1e7163239186019285c9d47dce829c2601e639cf9c50fff04e4c5d85N.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dfo67.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dfo67.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
286KB
MD5a6472176d6df8701df40241e39f522a3
SHA1db006a222ee46214c2dd0b32b4111b1e8cdd81b1
SHA2566a5ff7ebac804f9557696fec939bc41169382c23e35fb8f576f37538d8592bde
SHA512ce8de087f81086b6f3c94bfcdd82632aec3dd57552c2e6e245b448b07ae1e2c38908ee0ef0db7c2697e3ed9ad0261ab670c2cfa8a9b15b37abde8429f35d6ba3
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB
-
Filesize
3.6MB
-
Filesize
280KB
-
Filesize
5.6MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB
-
Filesize
1024KB
-
Filesize
300KB
-
Filesize
312KB