Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    75s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2022, 10:10

General

  • Target

    33447d4adcc5f22bbe29c073409538119be05c0be104df1938c704e53913e93c.exe

  • Size

    362KB

  • MD5

    7e5a95e4f6f4ba840e4e5de31ecf989a

  • SHA1

    674fc996747b2ed2ac9ee0af7d141084b977965e

  • SHA256

    33447d4adcc5f22bbe29c073409538119be05c0be104df1938c704e53913e93c

  • SHA512

    e61a33cf78a3674e890acf554fe99d6ee30cc5b1521ecaa06cf4822badc36587daaa887566badbe7842ff8af32b2ff904af96067c103b3140ec1acd688ddb29a

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\33447d4adcc5f22bbe29c073409538119be05c0be104df1938c704e53913e93c.exe
    "C:\Users\Admin\AppData\Local\Temp\33447d4adcc5f22bbe29c073409538119be05c0be104df1938c704e53913e93c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2804-115-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-116-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-117-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-118-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-119-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-120-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-121-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-122-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-123-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-124-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-125-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-126-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-127-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-128-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-129-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-131-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-132-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-130-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-133-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-134-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-135-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-136-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-137-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-138-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-139-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-140-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-141-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-142-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-143-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-144-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-145-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-147-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-146-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-148-0x0000000000310000-0x0000000000370000-memory.dmp

    Filesize

    384KB

  • memory/2804-149-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-150-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-151-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-152-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-153-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-154-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-155-0x0000000000A90000-0x0000000000A96000-memory.dmp

    Filesize

    24KB

  • memory/2804-156-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-157-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-158-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-159-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-160-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-161-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-162-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-163-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-164-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-165-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-166-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-167-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-168-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-169-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-170-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-171-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-172-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-173-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-174-0x000000000A830000-0x000000000AE36000-memory.dmp

    Filesize

    6.0MB

  • memory/2804-175-0x000000000A3B0000-0x000000000A4BA000-memory.dmp

    Filesize

    1.0MB

  • memory/2804-176-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-177-0x000000000A2E0000-0x000000000A2F2000-memory.dmp

    Filesize

    72KB

  • memory/2804-178-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-179-0x000000000A340000-0x000000000A37E000-memory.dmp

    Filesize

    248KB

  • memory/2804-180-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-181-0x000000000A4C0000-0x000000000A50B000-memory.dmp

    Filesize

    300KB

  • memory/2804-182-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-183-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-184-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-185-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-186-0x000000000A660000-0x000000000A6C6000-memory.dmp

    Filesize

    408KB

  • memory/2804-194-0x000000000B1E0000-0x000000000B272000-memory.dmp

    Filesize

    584KB

  • memory/2804-195-0x000000000B780000-0x000000000BC7E000-memory.dmp

    Filesize

    5.0MB

  • memory/2804-197-0x000000000B560000-0x000000000B722000-memory.dmp

    Filesize

    1.8MB

  • memory/2804-198-0x000000000C1B0000-0x000000000C6DC000-memory.dmp

    Filesize

    5.2MB

  • memory/2804-202-0x000000000BC80000-0x000000000BCF6000-memory.dmp

    Filesize

    472KB

  • memory/2804-203-0x000000000B4E0000-0x000000000B530000-memory.dmp

    Filesize

    320KB