Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2022, 06:53

General

  • Target

    c0768f336791f52b27931a21a7d7f354ded9691b09a418e1d8d6c1b8618a73bf.exe

  • Size

    361KB

  • MD5

    8a8b3ac89e84db59b9527d1e22ef7da5

  • SHA1

    cbfd441ed9254a8662b5fd0e280c9c43f85edf1e

  • SHA256

    c0768f336791f52b27931a21a7d7f354ded9691b09a418e1d8d6c1b8618a73bf

  • SHA512

    f89e1ea7dddf8b7599c1eb67dd9558853d97c444acf88702afc9d0ea8fa348eab16acd181a92fb6769f55a9f0b3a85e976d04d0f61428878f57e2da01eaa2615

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c0768f336791f52b27931a21a7d7f354ded9691b09a418e1d8d6c1b8618a73bf.exe
    "C:\Users\Admin\AppData\Local\Temp\c0768f336791f52b27931a21a7d7f354ded9691b09a418e1d8d6c1b8618a73bf.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1312

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1312-120-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-121-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-122-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-123-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-124-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-125-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-126-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-127-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-128-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-129-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-130-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-131-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-132-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-133-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-134-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-135-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-136-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-137-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-138-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-139-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-140-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-141-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-142-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-143-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-144-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-146-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-145-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-147-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-148-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-149-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-150-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-151-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-152-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-153-0x0000000000330000-0x0000000000390000-memory.dmp

    Filesize

    384KB

  • memory/1312-154-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-155-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-156-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-157-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-158-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-159-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-160-0x0000000004C00000-0x0000000004C06000-memory.dmp

    Filesize

    24KB

  • memory/1312-161-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-162-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-163-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-164-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-165-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-166-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-167-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-168-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-169-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-170-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-171-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-172-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-173-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-174-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-175-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-176-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-177-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-178-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-179-0x000000000A860000-0x000000000AE66000-memory.dmp

    Filesize

    6.0MB

  • memory/1312-180-0x000000000A3D0000-0x000000000A4DA000-memory.dmp

    Filesize

    1.0MB

  • memory/1312-181-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-182-0x000000000A300000-0x000000000A312000-memory.dmp

    Filesize

    72KB

  • memory/1312-183-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-184-0x000000000A360000-0x000000000A39E000-memory.dmp

    Filesize

    248KB

  • memory/1312-185-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-186-0x000000000A4E0000-0x000000000A52B000-memory.dmp

    Filesize

    300KB

  • memory/1312-187-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-188-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-189-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-190-0x000000000A6B0000-0x000000000A742000-memory.dmp

    Filesize

    584KB

  • memory/1312-191-0x000000000B370000-0x000000000B86E000-memory.dmp

    Filesize

    5.0MB

  • memory/1312-192-0x0000000077D10000-0x0000000077E9E000-memory.dmp

    Filesize

    1.6MB

  • memory/1312-194-0x000000000AE70000-0x000000000AED6000-memory.dmp

    Filesize

    408KB

  • memory/1312-202-0x000000000B2C0000-0x000000000B336000-memory.dmp

    Filesize

    472KB

  • memory/1312-203-0x000000000B870000-0x000000000B8C0000-memory.dmp

    Filesize

    320KB

  • memory/1312-204-0x000000000BB90000-0x000000000BD52000-memory.dmp

    Filesize

    1.8MB

  • memory/1312-205-0x000000000C290000-0x000000000C7BC000-memory.dmp

    Filesize

    5.2MB