Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2024, 20:24 UTC

General

  • Target

    wtrelaxing.exe

  • Size

    5.3MB

  • MD5

    ec9d7eb68b700dc7f81b7a808c4642ec

  • SHA1

    b9774feebd7f0c5335e50620dfb3659c7bb5d444

  • SHA256

    f75de77adc9eed21ec758c9f4616bd5a3b83022ed16b682406befad45e6f105b

  • SHA512

    08c2b36b6b2ef47b1d9e7fee1fc9d608940ff45799b83eba09293ef025c2ca574ae00f4597e93fcd0c61df008c06ee727f334bf58d4e577a936b057fa004bd7e

  • SSDEEP

    98304:XRN2eOEkA62kikrRBDAlHXtA84Pzwa3PPFRSlNTVdmynxIRAEQO1T1tCneS:X/hy2ki0RZq36lLJ3PPFRSzTVcST1y1E

Malware Config

Extracted

Family

redline

Botnet

1223

C2

80.85.241.28:36723

Attributes
  • auth_value

    1162933edb12f699eedc4c04dd76667a

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\wtrelaxing.exe
    "C:\Users\Admin\AppData\Local\Temp\wtrelaxing.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2052

Network

    No results found
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    80 B
    3
    2
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    80 B
    3
    2
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    80 B
    3
    2
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    40 B
    3
    1
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    120 B
    3
    3
  • 80.85.241.28:36723
    vbc.exe
    152 B
    40 B
    3
    1
No results found

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2052-7-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2052-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2052-22-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-13-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2052-21-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-17-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2052-3-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2052-11-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2052-20-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-5-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2052-19-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2052-9-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/2972-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

    Filesize

    4KB

  • memory/2972-1-0x0000000000E20000-0x000000000136C000-memory.dmp

    Filesize

    5.3MB

  • memory/2972-18-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2972-2-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.