Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/11/2024, 02:14
Static task
static1
Behavioral task
behavioral1
Sample
97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe
Resource
win10v2004-20241007-en
General
-
Target
97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe
-
Size
359KB
-
MD5
4e5a3b25cce7a35a2ee6c881ccf4545d
-
SHA1
2fc26ebfd90a8cb61c867aba539927912a1fd5c9
-
SHA256
97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31
-
SHA512
987967bf9d0970a1f3979705382a14e7305f6f362cac2adf57381c532313d1741969ae5f7567c8f3745448df83ad39f68a3c87986eef9ed3b1b1302d4e7367a1
-
SSDEEP
6144:bOiAcfq2KWRrd67NY1Tjp005CeC0v6IYPDWJ:b1Ad2jv/LC6
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2736-3-0x00000000049E0000-0x0000000004A1C000-memory.dmp family_redline behavioral1/memory/2736-5-0x0000000004A20000-0x0000000004A5A000-memory.dmp family_redline behavioral1/memory/2736-14-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-36-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-66-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-70-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-68-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-64-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-62-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-60-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-58-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-56-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-54-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-52-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-50-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-48-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-46-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-44-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-42-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-40-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-38-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-34-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-32-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-30-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-28-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-26-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-24-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-22-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-20-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-18-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-16-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-12-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-10-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-8-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline behavioral1/memory/2736-7-0x0000000004A20000-0x0000000004A55000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2736 97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe"C:\Users\Admin\AppData\Local\Temp\97754959e626382738aee5207ee5a4b8a1da677eef7219d95457b55e947eab31.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2736