Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2022, 12:30

General

  • Target

    612269c725cee13ddaf338a2b8bf54fd654fe1d9daab24a88da9040f72eb1625.exe

  • Size

    362KB

  • MD5

    257fb61e940327f68aad160da6058845

  • SHA1

    1c4fa263351328cf5cb24fea93420a23ad611437

  • SHA256

    612269c725cee13ddaf338a2b8bf54fd654fe1d9daab24a88da9040f72eb1625

  • SHA512

    54e3ac56dc40c2b9226e18847fc0be6785806558b97261dfc077fba87802778319006bb034d3ec40b8f16a5ce7f50db8b641e31cbcc32c92f35ec57cb1d0d3f9

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\612269c725cee13ddaf338a2b8bf54fd654fe1d9daab24a88da9040f72eb1625.exe
    "C:\Users\Admin\AppData\Local\Temp\612269c725cee13ddaf338a2b8bf54fd654fe1d9daab24a88da9040f72eb1625.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4876

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4876-120-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-121-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-122-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-123-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-124-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-125-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-126-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-127-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-128-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-129-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-130-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-131-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-132-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-133-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-134-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-135-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-136-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-137-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-139-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-138-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-140-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-141-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-142-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-143-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-144-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-145-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-146-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-147-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-148-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-149-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-150-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-151-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-152-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-153-0x00000000004B0000-0x0000000000510000-memory.dmp

    Filesize

    384KB

  • memory/4876-154-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-155-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-156-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-157-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-158-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-159-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-160-0x0000000000CE0000-0x0000000000CE6000-memory.dmp

    Filesize

    24KB

  • memory/4876-161-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-162-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-163-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-164-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-165-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-166-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-167-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-168-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-169-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-170-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-171-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-172-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-173-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-174-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-175-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-176-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-177-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-178-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-179-0x0000000005530000-0x0000000005B36000-memory.dmp

    Filesize

    6.0MB

  • memory/4876-180-0x0000000005070000-0x000000000517A000-memory.dmp

    Filesize

    1.0MB

  • memory/4876-181-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-182-0x0000000004FA0000-0x0000000004FB2000-memory.dmp

    Filesize

    72KB

  • memory/4876-183-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-184-0x0000000005000000-0x000000000503E000-memory.dmp

    Filesize

    248KB

  • memory/4876-185-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-186-0x0000000005180000-0x00000000051CB000-memory.dmp

    Filesize

    300KB

  • memory/4876-187-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-188-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-189-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-190-0x00000000771E0000-0x000000007736E000-memory.dmp

    Filesize

    1.6MB

  • memory/4876-191-0x0000000005320000-0x0000000005386000-memory.dmp

    Filesize

    408KB

  • memory/4876-199-0x0000000006050000-0x00000000060E2000-memory.dmp

    Filesize

    584KB

  • memory/4876-200-0x00000000065F0000-0x0000000006AEE000-memory.dmp

    Filesize

    5.0MB

  • memory/4876-202-0x0000000006AF0000-0x0000000006CB2000-memory.dmp

    Filesize

    1.8MB

  • memory/4876-203-0x00000000077D0000-0x0000000007CFC000-memory.dmp

    Filesize

    5.2MB

  • memory/4876-207-0x0000000006370000-0x00000000063E6000-memory.dmp

    Filesize

    472KB

  • memory/4876-208-0x00000000063F0000-0x0000000006440000-memory.dmp

    Filesize

    320KB