Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/10/2022, 04:32

221018-e51g6seeb8 10

18/10/2022, 04:06

221018-epj59aedd6 7

18/10/2022, 03:34

221018-d417mseefj 10

Analysis

  • max time kernel
    1616s
  • max time network
    1803s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2022, 04:32

General

  • Target

    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe

  • Size

    521KB

  • MD5

    c0318aa61a314fed79c87be28f0db3ba

  • SHA1

    361e5206d2e0aeb88174c524e6c7cfb90c94670d

  • SHA256

    be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b

  • SHA512

    619ad72faaa694d7dd141288c8f99738d3110fb2e08ea9a5feda3777d4d32456feca66a2e0da96a0610f475e358cb9bb99fc54a179fb98674f91cb205ff7a586

  • SSDEEP

    12288:bjNYGB77lC5eQoyLKWRIvwr222Zy+CQI1Cr2H:bjN99J2eOWF22ZaTe

Malware Config

Extracted

Family

redline

Botnet

BirjRo1

C2

79.137.197.136:23532

Attributes
  • auth_value

    278e5c62cf6a9bb4e0ab732b17b0368e

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Modifies WinLogon 2 TTPs 4 IoCs
  • Drops file in Windows directory 10 IoCs
  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe
    "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net user %username%
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2100
      • C:\Windows\SysWOW64\net.exe
        net user Admin
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4964
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 user Admin
          4⤵
            PID:4876
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe Set-ExecutionPolicy bypass -Force
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Set-ExecutionPolicy bypass -Force
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4936
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1140
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe Add-MpPreference -ExclusionPath C:\Windows\SvcManager
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2096
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell.exe C:\Windows\SvcManager\las.ps1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4168
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe C:\Windows\SvcManager\las.ps1
          3⤵
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4264
          • C:\Windows\SysWOW64\SecEdit.exe
            "C:\Windows\system32\SecEdit.exe" /export /cfg tempexport.inf
            4⤵
            • Drops file in Windows directory
            PID:5108
          • C:\Windows\SysWOW64\SecEdit.exe
            "C:\Windows\system32\SecEdit.exe" /import /db secedit.sdb /cfg .\tempimport.inf
            4⤵
              PID:4976
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db secedit.sdb
              4⤵
                PID:1584
              • C:\Windows\SysWOW64\gpupdate.exe
                "C:\Windows\system32\gpupdate.exe" /force
                4⤵
                  PID:1156
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c del /f C:\Windows\SvcManager\las.ps1
              2⤵
                PID:4600
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                2⤵
                  PID:3240
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\\extra.exe
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:5112
                  • C:\Users\Admin\AppData\Local\Temp\extra.exe
                    C:\Users\Admin\AppData\Local\Temp\\extra.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2396
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\be9d0c8a2051d70d4434e034647c8b675a38c1f08252c94c1620fbe663bd853b.exe"
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3788
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 1.1.1.1 -n 1 -w 3000
                    3⤵
                    • Runs ping.exe
                    PID:3092
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3216 -s 808
                  2⤵
                  • Program crash
                  PID:708
              • C:\Windows\SvcManager\svcmgr.exe
                C:\Windows\SvcManager\svcmgr.exe
                1⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                • Suspicious use of AdjustPrivilegeToken
                PID:2696
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3216 -ip 3216
                1⤵
                  PID:4944

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                  Filesize

                  2KB

                  MD5

                  74beabd4347b1ecc24fdc6cd9bb2ec64

                  SHA1

                  b793909bd2bf91d40eafb71194cc3eeb0c057110

                  SHA256

                  80d19c23e407ccffe9f5b43087c752b2157294a1e42d887705b9924ceb9e6af9

                  SHA512

                  f36be6d71e6ae79ffa79e9bc8d57e79cc14ace932fcc2106ab4df8f4ba99506dac3c007d986dfe3bf8884977a411ba1faa713489dc27b25c23bec49d42abd802

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  16KB

                  MD5

                  af7e6457f23e3e3c1282029c05277211

                  SHA1

                  1e7dc23cb34061e5fc499d67a5f5ad2be08d53f4

                  SHA256

                  4ec09c21644a4c8fe75dd16cde4ba26ef87a4d0e8c35c0427d452f2797e4d43d

                  SHA512

                  7a1bfd35e88bf444eaa5a196fdd36b5e90d1fd3b2709bcc36da5cf8fac7dc4bc505122256012c31fc0b6b9cd55987c2c4c5b038ed9c2665d393c03b5c8da8e21

                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                  Filesize

                  18KB

                  MD5

                  80e90054166c4a2905901ce7a11647be

                  SHA1

                  299e86309714bb8e8acd7b53aee4d72a188bfc12

                  SHA256

                  e9eb8cb8a32d04afc7f68f2885df93993dafef52d69f8fed2e37a689510977bd

                  SHA512

                  0ad7596d2fb1404151b40d550171d215dcaf14bd703d1f5df2bcad4888fd7887040abc6201f3a12f4e3db17b929472fa6c626e3228827aea958af7bf33e764f6

                • C:\Users\Admin\AppData\Local\Temp\extra.exe

                  Filesize

                  137KB

                  MD5

                  0072395e192397b4f98bbb6852d1d495

                  SHA1

                  8246494746644b90380a4458e9248e7f3341ad8f

                  SHA256

                  f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c

                  SHA512

                  1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d

                • C:\Users\Admin\AppData\Local\Temp\extra.exe

                  Filesize

                  137KB

                  MD5

                  0072395e192397b4f98bbb6852d1d495

                  SHA1

                  8246494746644b90380a4458e9248e7f3341ad8f

                  SHA256

                  f6eb83f11c4e97e037def9bcca9685beaf38e7a172f4b60e28ba9b479657db2c

                  SHA512

                  1c5cba2c03ccb36faf837a69f89789f854e5625a428990427d2fca796864420b5648889157ef79efc10b6873a59e640aa6ac4a6ced1652927f3f9eab0b7d9e5d

                • C:\Windows\SvcManager\las.ps1

                  Filesize

                  1KB

                  MD5

                  9a6fbc01aa4147aa5aa91fca92ef6dfd

                  SHA1

                  f8b47020022626abef69f2032d22e89b95b994a8

                  SHA256

                  f63923ddc20574ca230a3b51bf7a6bf158a53f84494e2081071c3469abb068ca

                  SHA512

                  a80c89c1daa41d8c1f5c71ec06db7eaf6f686f4726ef5cce8d8854371fec4dfa88b4649ee7f78c59ff4f1f00a7296a917696a760228ce59206c09d3d7e954990

                • C:\Windows\SvcManager\svcmgr.exe

                  Filesize

                  788KB

                  MD5

                  621074969d8ccca5585201b6268e2faf

                  SHA1

                  252f556025ec03884edfd793da95179e31b055e5

                  SHA256

                  e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe

                  SHA512

                  0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a

                • C:\Windows\SvcManager\svcmgr.exe

                  Filesize

                  788KB

                  MD5

                  621074969d8ccca5585201b6268e2faf

                  SHA1

                  252f556025ec03884edfd793da95179e31b055e5

                  SHA256

                  e707fad41b65d06c3b6e7b2a61aa616c8256546cd9fae1acf5fa0e07d62034fe

                  SHA512

                  0806a33113d2586014abbd9725443a95836ca3ae4a8e9e6d08537dd6059d4ac38112b53f7da5a548c89e6331f2bf6ffb386cb5714491f86975a9f852a7781a3a

                • C:\Windows\SvcManager\tempexport.inf

                  Filesize

                  16KB

                  MD5

                  12521efd8145d438a53ae40ea56dca29

                  SHA1

                  cdf74522965a8d0b8ee74e1f49698fc334251a66

                  SHA256

                  621c13968a16a9280f14cea9e2577678af7129f6899615defebc08782eb8b756

                  SHA512

                  23086f47ce9cafcbe035d69a2bb3c86bed17029226e0b2a8ec33823d0515287f52a989cbc6aa6dd8fb7425dd6ddf0cd819c248a18d76de587839fb44404c2206

                • memory/2096-160-0x0000000007D70000-0x0000000007D78000-memory.dmp

                  Filesize

                  32KB

                • memory/2096-159-0x0000000007D90000-0x0000000007DAA000-memory.dmp

                  Filesize

                  104KB

                • memory/2096-158-0x0000000007C80000-0x0000000007C8E000-memory.dmp

                  Filesize

                  56KB

                • memory/2096-157-0x0000000070760000-0x00000000707AC000-memory.dmp

                  Filesize

                  304KB

                • memory/2396-192-0x0000000006090000-0x0000000006122000-memory.dmp

                  Filesize

                  584KB

                • memory/2396-195-0x00000000062B0000-0x0000000006300000-memory.dmp

                  Filesize

                  320KB

                • memory/2396-188-0x0000000005240000-0x000000000534A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/2396-190-0x00000000051E0000-0x000000000521C000-memory.dmp

                  Filesize

                  240KB

                • memory/2396-185-0x0000000000900000-0x0000000000928000-memory.dmp

                  Filesize

                  160KB

                • memory/2396-187-0x00000000056D0000-0x0000000005CE8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/2396-189-0x0000000005180000-0x0000000005192000-memory.dmp

                  Filesize

                  72KB

                • memory/2396-193-0x0000000006480000-0x0000000006642000-memory.dmp

                  Filesize

                  1.8MB

                • memory/2396-194-0x00000000071C0000-0x00000000076EC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/2696-186-0x00007FFAD8D30000-0x00007FFAD97F1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2696-191-0x000001BF6F4E0000-0x000001BF6F502000-memory.dmp

                  Filesize

                  136KB

                • memory/2696-196-0x00007FFAD8D30000-0x00007FFAD97F1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2696-180-0x000001BF55500000-0x000001BF555CC000-memory.dmp

                  Filesize

                  816KB

                • memory/3216-164-0x0000000000400000-0x00000000005DF000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3216-139-0x00000000021F0000-0x0000000002291000-memory.dmp

                  Filesize

                  644KB

                • memory/3216-137-0x0000000000822000-0x000000000087E000-memory.dmp

                  Filesize

                  368KB

                • memory/3216-140-0x0000000000400000-0x00000000005DF000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3216-199-0x0000000000400000-0x00000000005DF000-memory.dmp

                  Filesize

                  1.9MB

                • memory/3216-163-0x0000000000822000-0x000000000087E000-memory.dmp

                  Filesize

                  368KB

                • memory/4264-172-0x00000000078A0000-0x00000000078BE000-memory.dmp

                  Filesize

                  120KB

                • memory/4264-168-0x0000000008170000-0x0000000008714000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4264-167-0x0000000006CF0000-0x0000000006D12000-memory.dmp

                  Filesize

                  136KB

                • memory/4264-171-0x0000000007C40000-0x0000000007CB6000-memory.dmp

                  Filesize

                  472KB

                • memory/4936-151-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

                  Filesize

                  40KB

                • memory/4936-148-0x0000000006220000-0x000000000623E000-memory.dmp

                  Filesize

                  120KB

                • memory/4936-141-0x0000000005050000-0x0000000005678000-memory.dmp

                  Filesize

                  6.2MB

                • memory/4936-138-0x0000000002320000-0x0000000002356000-memory.dmp

                  Filesize

                  216KB

                • memory/4936-142-0x0000000004DC0000-0x0000000004DE2000-memory.dmp

                  Filesize

                  136KB

                • memory/4936-143-0x0000000004F20000-0x0000000004F86000-memory.dmp

                  Filesize

                  408KB

                • memory/4936-144-0x0000000005680000-0x00000000056E6000-memory.dmp

                  Filesize

                  408KB

                • memory/4936-152-0x00000000071F0000-0x0000000007286000-memory.dmp

                  Filesize

                  600KB

                • memory/4936-150-0x0000000006F70000-0x0000000006F8A000-memory.dmp

                  Filesize

                  104KB

                • memory/4936-149-0x00000000075B0000-0x0000000007C2A000-memory.dmp

                  Filesize

                  6.5MB

                • memory/4936-147-0x0000000070760000-0x00000000707AC000-memory.dmp

                  Filesize

                  304KB

                • memory/4936-146-0x0000000006C20000-0x0000000006C52000-memory.dmp

                  Filesize

                  200KB

                • memory/4936-145-0x0000000005C70000-0x0000000005C8E000-memory.dmp

                  Filesize

                  120KB