Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    75s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2022, 16:35

General

  • Target

    c4d14a40143f9deedd0104526a9a4d221897aed975b7e21482aa5b73e7399ade.exe

  • Size

    362KB

  • MD5

    5287daac12b25f7268dba5a86fe377aa

  • SHA1

    c1158d46cd66b9c500afad7528c4cf7bfe33abef

  • SHA256

    c4d14a40143f9deedd0104526a9a4d221897aed975b7e21482aa5b73e7399ade

  • SHA512

    c7f65ded998e3398dde3eea0cc5e780aecb8a37193302582a1cb6487d66b9e76c52296d8da1235ccbc90bda3c3844fc79c668b2ab10f7b691d57a00dcdb078b1

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4d14a40143f9deedd0104526a9a4d221897aed975b7e21482aa5b73e7399ade.exe
    "C:\Users\Admin\AppData\Local\Temp\c4d14a40143f9deedd0104526a9a4d221897aed975b7e21482aa5b73e7399ade.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2804-115-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-116-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-117-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-118-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-119-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-120-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-121-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-122-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-123-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-124-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-125-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-126-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-127-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-128-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-129-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-130-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-131-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-132-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-133-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-134-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-135-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-136-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-138-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-137-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-139-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-140-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-141-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-142-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-144-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-143-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-145-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-146-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-147-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-148-0x0000000000760000-0x00000000007C0000-memory.dmp

    Filesize

    384KB

  • memory/2804-149-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-150-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-151-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-152-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-153-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-154-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-155-0x0000000002960000-0x0000000002966000-memory.dmp

    Filesize

    24KB

  • memory/2804-156-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-157-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-158-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-159-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-160-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-161-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-162-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-163-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-164-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-165-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-166-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-167-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-168-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-169-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-170-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-171-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-172-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-173-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-174-0x000000000AC70000-0x000000000B276000-memory.dmp

    Filesize

    6.0MB

  • memory/2804-175-0x000000000A800000-0x000000000A90A000-memory.dmp

    Filesize

    1.0MB

  • memory/2804-176-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-177-0x000000000A730000-0x000000000A742000-memory.dmp

    Filesize

    72KB

  • memory/2804-178-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-179-0x000000000A790000-0x000000000A7CE000-memory.dmp

    Filesize

    248KB

  • memory/2804-180-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-181-0x000000000A910000-0x000000000A95B000-memory.dmp

    Filesize

    300KB

  • memory/2804-182-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-183-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-184-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-185-0x000000000B280000-0x000000000B312000-memory.dmp

    Filesize

    584KB

  • memory/2804-186-0x000000000B820000-0x000000000BD1E000-memory.dmp

    Filesize

    5.0MB

  • memory/2804-187-0x0000000076FE0000-0x000000007716E000-memory.dmp

    Filesize

    1.6MB

  • memory/2804-189-0x000000000ABB0000-0x000000000AC16000-memory.dmp

    Filesize

    408KB

  • memory/2804-197-0x000000000BDA0000-0x000000000BE16000-memory.dmp

    Filesize

    472KB

  • memory/2804-198-0x000000000BD20000-0x000000000BD70000-memory.dmp

    Filesize

    320KB

  • memory/2804-199-0x000000000BFF0000-0x000000000C1B2000-memory.dmp

    Filesize

    1.8MB

  • memory/2804-200-0x000000000C6F0000-0x000000000CC1C000-memory.dmp

    Filesize

    5.2MB