Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2024, 20:47
Static task
static1
Behavioral task
behavioral1
Sample
2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe
Resource
win10v2004-20241007-en
General
-
Target
2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe
-
Size
476KB
-
MD5
552dc0022f8adf534460b34a01ed8c6f
-
SHA1
29f5f1cf735a2473058de493168ad5e2a446dd4a
-
SHA256
2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3
-
SHA512
5fe66b9f4818cdba0523b1831584e0c5cf4c7121431aeb1e14170dee2b7da697fb33374991bdf910e7966a002caaeb9ddd50858cd3bc059a2d9c23004517ea35
-
SSDEEP
12288:9MrIy90IHyVN5V0mlQ0z36tvg2RmV2Wm89:1ymVFC0L61gMXWL9
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023cb3-12.dat family_redline behavioral1/memory/3640-15-0x00000000004F0000-0x0000000000522000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 2 IoCs
pid Process 4424 nJW99.exe 3640 bSv47.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nJW99.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nJW99.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bSv47.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2760 wrote to memory of 4424 2760 2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe 83 PID 2760 wrote to memory of 4424 2760 2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe 83 PID 2760 wrote to memory of 4424 2760 2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe 83 PID 4424 wrote to memory of 3640 4424 nJW99.exe 84 PID 4424 wrote to memory of 3640 4424 nJW99.exe 84 PID 4424 wrote to memory of 3640 4424 nJW99.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe"C:\Users\Admin\AppData\Local\Temp\2c558f583ef12070ea83d6d7988c61bd3c8a60145013ba4b823cb30d8fe1e6c3.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nJW99.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nJW99.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bSv47.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bSv47.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3640
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
202KB
MD52bf88c73165dabcc344513bd9ee97ee2
SHA111ffd144a0ebf9cc3ef4ea283613776cb0f3da86
SHA256dcdff4a1bf231ee65cf7690a52ba7d660c35e54a48c7e810c07af23c94f3bd64
SHA5126d5e0648684c0676c2a260b66e765dd1dd093f0da191be0da98157588494df52ea35ee11c0151f5f55491c283c0d692f079dce3c7e5244e34e95a6d01dd60820
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2