Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2022, 11:39

General

  • Target

    d8ca08b15c1a43f966db8f84bae5e678.exe

  • Size

    317KB

  • MD5

    d8ca08b15c1a43f966db8f84bae5e678

  • SHA1

    2402d7403a9af170d7e6296268f24dcfc5c0f277

  • SHA256

    beca004dfd77f218a00baeb20a2e0d26ffcb0e8c88abc1fcdec9b8b78e289255

  • SHA512

    5927c31941690f796d90861147857fd47daa8f9844fe07b5fc4a5c1b638fe7dde2710174209111ff1ace7b7d900fdb0031e8ff79259dfeea40351f22f3aa377d

  • SSDEEP

    3072:OaXPELJFcIttkaeB251cVM5ZlPrZJaaAKV0KwSxceEwM/h3BsxkgaBChU/pZa9uF:O62+HrV2Z4afV00ZnigabwVf

Malware Config

Extracted

Family

redline

Botnet

11

C2

77.73.134.27:7161

Attributes
  • auth_value

    e6aadafed1fda7723d7655a5894828d2

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8ca08b15c1a43f966db8f84bae5e678.exe
    "C:\Users\Admin\AppData\Local\Temp\d8ca08b15c1a43f966db8f84bae5e678.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3424
  • C:\Users\Admin\AppData\Local\Temp\EBBC.exe
    C:\Users\Admin\AppData\Local\Temp\EBBC.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4840
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:102816
  • C:\Users\Admin\AppData\Local\Temp\F860.exe
    C:\Users\Admin\AppData\Local\Temp\F860.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:102876
  • C:\Users\Admin\AppData\Local\Temp\2E0.exe
    C:\Users\Admin\AppData\Local\Temp\2E0.exe
    1⤵
    • Executes dropped EXE
    PID:102980
  • C:\Users\Admin\AppData\Local\Temp\1223.exe
    C:\Users\Admin\AppData\Local\Temp\1223.exe
    1⤵
    • Executes dropped EXE
    PID:103124
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:103180
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:103228
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:103276
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:103300
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:103336
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:103368
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:103400
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:102836
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:2716
                    • C:\Users\Admin\AppData\Roaming\bsfafjt
                      C:\Users\Admin\AppData\Roaming\bsfafjt
                      1⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:4348

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\1223.exe

                      Filesize

                      306KB

                      MD5

                      8f08e6baa2f0c507e4e961769f5c1261

                      SHA1

                      d3f04db2aa4f31613fde0b8cafaa339ff704141b

                      SHA256

                      f87ba1386548acfb9894c511e07aca4a4d41ec2f3eeccae2dc5ec18b5bbcc510

                      SHA512

                      85dd017d496cb4a0944b944c5257e3ca2a2b966fdda314920b045fd419c13b717fc796e6db80173054cac7f2088e33166b3c63aeb1dd35c880a802be85ef8ac2

                    • C:\Users\Admin\AppData\Local\Temp\1223.exe

                      Filesize

                      306KB

                      MD5

                      8f08e6baa2f0c507e4e961769f5c1261

                      SHA1

                      d3f04db2aa4f31613fde0b8cafaa339ff704141b

                      SHA256

                      f87ba1386548acfb9894c511e07aca4a4d41ec2f3eeccae2dc5ec18b5bbcc510

                      SHA512

                      85dd017d496cb4a0944b944c5257e3ca2a2b966fdda314920b045fd419c13b717fc796e6db80173054cac7f2088e33166b3c63aeb1dd35c880a802be85ef8ac2

                    • C:\Users\Admin\AppData\Local\Temp\2E0.exe

                      Filesize

                      346KB

                      MD5

                      38449a426d17b1a3571eb00afb8af3bc

                      SHA1

                      2a1000c521911cf9696a1b4e5d80fcb17b7823b1

                      SHA256

                      ae4dbb3b0f3864772c74bca8681e5ed01131fcc8897ced067d1d55825afec5cf

                      SHA512

                      9786ab5399884512e8be1abf8efb8d69240a5fdfcd4f3d187ac8063cdc8cfa30baab4fd1c4783ee58315ece4f48fb655381c1732a06d28de82f2c206cdea63d0

                    • C:\Users\Admin\AppData\Local\Temp\2E0.exe

                      Filesize

                      346KB

                      MD5

                      38449a426d17b1a3571eb00afb8af3bc

                      SHA1

                      2a1000c521911cf9696a1b4e5d80fcb17b7823b1

                      SHA256

                      ae4dbb3b0f3864772c74bca8681e5ed01131fcc8897ced067d1d55825afec5cf

                      SHA512

                      9786ab5399884512e8be1abf8efb8d69240a5fdfcd4f3d187ac8063cdc8cfa30baab4fd1c4783ee58315ece4f48fb655381c1732a06d28de82f2c206cdea63d0

                    • C:\Users\Admin\AppData\Local\Temp\EBBC.exe

                      Filesize

                      2.6MB

                      MD5

                      68d0826f868433f44dd9aaf631f7d616

                      SHA1

                      3ba777f68d4e4051317b0676c0eea794f3515dfa

                      SHA256

                      e51fb04aabdb1102bf3ee0a0dd8d4d19e43b3f7735d5839391af244660152e55

                      SHA512

                      e00313c5c637f3db1a612c38c4a67bab0b5b5a7443264bb63f8c266e2d5f70d58688c776f301753049ca8f8672b921162fffc8cf563eccf9462fda89f6aaccc2

                    • C:\Users\Admin\AppData\Local\Temp\EBBC.exe

                      Filesize

                      2.6MB

                      MD5

                      68d0826f868433f44dd9aaf631f7d616

                      SHA1

                      3ba777f68d4e4051317b0676c0eea794f3515dfa

                      SHA256

                      e51fb04aabdb1102bf3ee0a0dd8d4d19e43b3f7735d5839391af244660152e55

                      SHA512

                      e00313c5c637f3db1a612c38c4a67bab0b5b5a7443264bb63f8c266e2d5f70d58688c776f301753049ca8f8672b921162fffc8cf563eccf9462fda89f6aaccc2

                    • C:\Users\Admin\AppData\Local\Temp\F860.exe

                      Filesize

                      255KB

                      MD5

                      07ea3bc2b9eaacd002de4f59803ef234

                      SHA1

                      8a796069e5eac844f40b4487c80ed1c93316a331

                      SHA256

                      2302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1

                      SHA512

                      d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092

                    • C:\Users\Admin\AppData\Local\Temp\F860.exe

                      Filesize

                      255KB

                      MD5

                      07ea3bc2b9eaacd002de4f59803ef234

                      SHA1

                      8a796069e5eac844f40b4487c80ed1c93316a331

                      SHA256

                      2302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1

                      SHA512

                      d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092

                    • C:\Users\Admin\AppData\Roaming\bsfafjt

                      Filesize

                      317KB

                      MD5

                      d8ca08b15c1a43f966db8f84bae5e678

                      SHA1

                      2402d7403a9af170d7e6296268f24dcfc5c0f277

                      SHA256

                      beca004dfd77f218a00baeb20a2e0d26ffcb0e8c88abc1fcdec9b8b78e289255

                      SHA512

                      5927c31941690f796d90861147857fd47daa8f9844fe07b5fc4a5c1b638fe7dde2710174209111ff1ace7b7d900fdb0031e8ff79259dfeea40351f22f3aa377d

                    • C:\Users\Admin\AppData\Roaming\bsfafjt

                      Filesize

                      317KB

                      MD5

                      d8ca08b15c1a43f966db8f84bae5e678

                      SHA1

                      2402d7403a9af170d7e6296268f24dcfc5c0f277

                      SHA256

                      beca004dfd77f218a00baeb20a2e0d26ffcb0e8c88abc1fcdec9b8b78e289255

                      SHA512

                      5927c31941690f796d90861147857fd47daa8f9844fe07b5fc4a5c1b638fe7dde2710174209111ff1ace7b7d900fdb0031e8ff79259dfeea40351f22f3aa377d

                    • memory/2716-210-0x00000000006E0000-0x00000000006E8000-memory.dmp

                      Filesize

                      32KB

                    • memory/2716-196-0x00000000006E0000-0x00000000006E8000-memory.dmp

                      Filesize

                      32KB

                    • memory/2716-197-0x00000000006D0000-0x00000000006DB000-memory.dmp

                      Filesize

                      44KB

                    • memory/3424-133-0x0000000000460000-0x0000000000469000-memory.dmp

                      Filesize

                      36KB

                    • memory/3424-134-0x0000000000400000-0x0000000000454000-memory.dmp

                      Filesize

                      336KB

                    • memory/3424-132-0x000000000049E000-0x00000000004AE000-memory.dmp

                      Filesize

                      64KB

                    • memory/3424-135-0x0000000000400000-0x0000000000454000-memory.dmp

                      Filesize

                      336KB

                    • memory/4348-211-0x0000000000400000-0x0000000000454000-memory.dmp

                      Filesize

                      336KB

                    • memory/4348-207-0x0000000000400000-0x0000000000454000-memory.dmp

                      Filesize

                      336KB

                    • memory/4348-206-0x00000000007CF000-0x00000000007DF000-memory.dmp

                      Filesize

                      64KB

                    • memory/102816-140-0x0000000000400000-0x0000000000428000-memory.dmp

                      Filesize

                      160KB

                    • memory/102816-151-0x00000000059B0000-0x00000000059EC000-memory.dmp

                      Filesize

                      240KB

                    • memory/102816-145-0x0000000005EC0000-0x00000000064D8000-memory.dmp

                      Filesize

                      6.1MB

                    • memory/102816-149-0x0000000005950000-0x0000000005962000-memory.dmp

                      Filesize

                      72KB

                    • memory/102816-146-0x0000000005A20000-0x0000000005B2A000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/102836-209-0x0000000000400000-0x0000000000407000-memory.dmp

                      Filesize

                      28KB

                    • memory/102836-194-0x00000000001F0000-0x00000000001FD000-memory.dmp

                      Filesize

                      52KB

                    • memory/102836-193-0x0000000000400000-0x0000000000407000-memory.dmp

                      Filesize

                      28KB

                    • memory/102876-155-0x0000000000400000-0x000000000059A000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/102876-175-0x0000000000400000-0x000000000059A000-memory.dmp

                      Filesize

                      1.6MB

                    • memory/102876-165-0x00000000078B0000-0x0000000007DDC000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/102876-164-0x00000000076D0000-0x0000000007892000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/102876-163-0x0000000006790000-0x00000000067AE000-memory.dmp

                      Filesize

                      120KB

                    • memory/102876-162-0x00000000075C0000-0x0000000007636000-memory.dmp

                      Filesize

                      472KB

                    • memory/102876-174-0x00000000008D9000-0x0000000000903000-memory.dmp

                      Filesize

                      168KB

                    • memory/102876-157-0x0000000005D50000-0x0000000005DB6000-memory.dmp

                      Filesize

                      408KB

                    • memory/102876-161-0x0000000007570000-0x00000000075C0000-memory.dmp

                      Filesize

                      320KB

                    • memory/102876-152-0x0000000004D10000-0x00000000052B4000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/102876-156-0x0000000005CB0000-0x0000000005D42000-memory.dmp

                      Filesize

                      584KB

                    • memory/102876-153-0x00000000008D9000-0x0000000000903000-memory.dmp

                      Filesize

                      168KB

                    • memory/102876-154-0x0000000000820000-0x0000000000858000-memory.dmp

                      Filesize

                      224KB

                    • memory/103180-200-0x00000000001A0000-0x00000000001A7000-memory.dmp

                      Filesize

                      28KB

                    • memory/103180-172-0x0000000000190000-0x000000000019B000-memory.dmp

                      Filesize

                      44KB

                    • memory/103180-171-0x00000000001A0000-0x00000000001A7000-memory.dmp

                      Filesize

                      28KB

                    • memory/103228-201-0x0000000001200000-0x0000000001209000-memory.dmp

                      Filesize

                      36KB

                    • memory/103228-177-0x0000000001200000-0x0000000001209000-memory.dmp

                      Filesize

                      36KB

                    • memory/103228-173-0x0000000000FF0000-0x0000000000FFF000-memory.dmp

                      Filesize

                      60KB

                    • memory/103276-179-0x00000000006A0000-0x00000000006A5000-memory.dmp

                      Filesize

                      20KB

                    • memory/103276-180-0x0000000000690000-0x0000000000699000-memory.dmp

                      Filesize

                      36KB

                    • memory/103276-202-0x00000000006A0000-0x00000000006A5000-memory.dmp

                      Filesize

                      20KB

                    • memory/103300-181-0x0000000000DF0000-0x0000000000DFC000-memory.dmp

                      Filesize

                      48KB

                    • memory/103300-183-0x0000000001000000-0x0000000001006000-memory.dmp

                      Filesize

                      24KB

                    • memory/103300-203-0x0000000001000000-0x0000000001006000-memory.dmp

                      Filesize

                      24KB

                    • memory/103336-204-0x0000000001310000-0x0000000001332000-memory.dmp

                      Filesize

                      136KB

                    • memory/103336-185-0x00000000012E0000-0x0000000001307000-memory.dmp

                      Filesize

                      156KB

                    • memory/103336-184-0x0000000001310000-0x0000000001332000-memory.dmp

                      Filesize

                      136KB

                    • memory/103368-187-0x00000000007D0000-0x00000000007D5000-memory.dmp

                      Filesize

                      20KB

                    • memory/103368-205-0x00000000007D0000-0x00000000007D5000-memory.dmp

                      Filesize

                      20KB

                    • memory/103368-188-0x00000000007C0000-0x00000000007C9000-memory.dmp

                      Filesize

                      36KB

                    • memory/103400-191-0x0000000000350000-0x000000000035B000-memory.dmp

                      Filesize

                      44KB

                    • memory/103400-208-0x0000000000360000-0x0000000000366000-memory.dmp

                      Filesize

                      24KB

                    • memory/103400-190-0x0000000000360000-0x0000000000366000-memory.dmp

                      Filesize

                      24KB