Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    133s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26/09/2022, 04:35

General

  • Target

    c43c5efaea65c7846ec87bca360ab3639b4f28bb86b018e1131f473b84292d70.exe

  • Size

    363KB

  • MD5

    c20ab93c1d6ed13ca8eb8858774bd9d7

  • SHA1

    e4445372d8bf289f57494ac1a60244a767f4650c

  • SHA256

    c43c5efaea65c7846ec87bca360ab3639b4f28bb86b018e1131f473b84292d70

  • SHA512

    b007eb42e5ce507c7f8b1f5c8ffbc5284abc6bcba2d2885956b3145d8483d3e1ee19593ac3aaf513e4c2e93b56ce39dc5ff6bbdefe816d9ab3d010562435bde2

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c43c5efaea65c7846ec87bca360ab3639b4f28bb86b018e1131f473b84292d70.exe
    "C:\Users\Admin\AppData\Local\Temp\c43c5efaea65c7846ec87bca360ab3639b4f28bb86b018e1131f473b84292d70.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2252

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2252-116-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-117-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-118-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-120-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-119-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-121-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-122-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-123-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-124-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-125-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-126-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-127-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-128-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-129-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-130-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-131-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-132-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-133-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-134-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-135-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-136-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-137-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-138-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-139-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-140-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-141-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-142-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-143-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-144-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-145-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-146-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-147-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-148-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-149-0x0000000000B10000-0x0000000000B70000-memory.dmp

    Filesize

    384KB

  • memory/2252-150-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-151-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-152-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-153-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-154-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-155-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-156-0x0000000007770000-0x0000000007776000-memory.dmp

    Filesize

    24KB

  • memory/2252-157-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-158-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-159-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-160-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-161-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-162-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-163-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-164-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-165-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-166-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-167-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-168-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-169-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-170-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-171-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-172-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-173-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-174-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-175-0x000000000B020000-0x000000000B626000-memory.dmp

    Filesize

    6.0MB

  • memory/2252-176-0x000000000ABB0000-0x000000000ACBA000-memory.dmp

    Filesize

    1.0MB

  • memory/2252-177-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-178-0x000000000AAE0000-0x000000000AAF2000-memory.dmp

    Filesize

    72KB

  • memory/2252-179-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-180-0x000000000AB40000-0x000000000AB7E000-memory.dmp

    Filesize

    248KB

  • memory/2252-181-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-182-0x000000000ACC0000-0x000000000AD0B000-memory.dmp

    Filesize

    300KB

  • memory/2252-183-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-184-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-185-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-186-0x000000000B630000-0x000000000B6C2000-memory.dmp

    Filesize

    584KB

  • memory/2252-187-0x000000000BBD0000-0x000000000C0CE000-memory.dmp

    Filesize

    5.0MB

  • memory/2252-188-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2252-190-0x000000000AF70000-0x000000000AFD6000-memory.dmp

    Filesize

    408KB

  • memory/2252-198-0x000000000C2A0000-0x000000000C462000-memory.dmp

    Filesize

    1.8MB

  • memory/2252-199-0x000000000C9A0000-0x000000000CECC000-memory.dmp

    Filesize

    5.2MB

  • memory/2252-203-0x000000000C470000-0x000000000C4E6000-memory.dmp

    Filesize

    472KB

  • memory/2252-204-0x000000000C210000-0x000000000C260000-memory.dmp

    Filesize

    320KB