Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    177s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/01/2023, 22:20

General

  • Target

    ff5323a32673dda6983d1bc8a5840c7980ef231758b6128834d2e3432d53d790.exe

  • Size

    358KB

  • MD5

    28ee8c7da8d0e960570a4f81eaee2d1a

  • SHA1

    5ab7f96575352911f2d0cf7bf808c35b0e6aef87

  • SHA256

    ff5323a32673dda6983d1bc8a5840c7980ef231758b6128834d2e3432d53d790

  • SHA512

    016c48199401b51260375b60c75d5348fd90e281838aeec5f5b28b118b30e28dbc8b873cd2160514f56dcb584a95599fd348c8f67b3e467a513f5c96514b9fe5

  • SSDEEP

    6144:AALS8KMuEODgHX/nBXld1Ua/2lXYDBN7JRGbv8inE8SDD0SV4b7i:AAm8KMuEjvD+wrS4Um4bu

Malware Config

Extracted

Family

redline

Botnet

sport

C2

31.41.244.98:4063

Attributes
  • auth_value

    82cce55eeb56b322651e98032c09d225

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff5323a32673dda6983d1bc8a5840c7980ef231758b6128834d2e3432d53d790.exe
    "C:\Users\Admin\AppData\Local\Temp\ff5323a32673dda6983d1bc8a5840c7980ef231758b6128834d2e3432d53d790.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2172

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2172-120-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-121-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-122-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-123-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-124-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-125-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-126-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-127-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-128-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-129-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-130-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-131-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-132-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-133-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-134-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-135-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-137-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-136-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-138-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-139-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-140-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-141-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-142-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-143-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-145-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-146-0x00000000021D0000-0x000000000221B000-memory.dmp

    Filesize

    300KB

  • memory/2172-144-0x000000000074A000-0x0000000000778000-memory.dmp

    Filesize

    184KB

  • memory/2172-147-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-148-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-149-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-150-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-151-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-152-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-153-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-154-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-155-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB

  • memory/2172-156-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-157-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-158-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-159-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-161-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-160-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-162-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-163-0x0000000002580000-0x00000000025C6000-memory.dmp

    Filesize

    280KB

  • memory/2172-164-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-165-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-166-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-167-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-168-0x0000000004CF0000-0x00000000051EE000-memory.dmp

    Filesize

    5.0MB

  • memory/2172-169-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-170-0x0000000004B70000-0x0000000004BB4000-memory.dmp

    Filesize

    272KB

  • memory/2172-171-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-172-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-173-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-174-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-175-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-176-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-177-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-178-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-179-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-180-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-181-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-182-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-183-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-184-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-185-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-186-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-187-0x00000000051F0000-0x00000000057F6000-memory.dmp

    Filesize

    6.0MB

  • memory/2172-188-0x0000000005800000-0x000000000590A000-memory.dmp

    Filesize

    1.0MB

  • memory/2172-189-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-190-0x0000000004C70000-0x0000000004C82000-memory.dmp

    Filesize

    72KB

  • memory/2172-191-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-192-0x0000000004C90000-0x0000000004CCE000-memory.dmp

    Filesize

    248KB

  • memory/2172-193-0x00000000779B0000-0x0000000077B3E000-memory.dmp

    Filesize

    1.6MB

  • memory/2172-194-0x0000000005A10000-0x0000000005A5B000-memory.dmp

    Filesize

    300KB

  • memory/2172-198-0x000000000074A000-0x0000000000778000-memory.dmp

    Filesize

    184KB

  • memory/2172-199-0x00000000021D0000-0x000000000221B000-memory.dmp

    Filesize

    300KB

  • memory/2172-201-0x0000000005BA0000-0x0000000005C06000-memory.dmp

    Filesize

    408KB

  • memory/2172-209-0x0000000006250000-0x00000000062E2000-memory.dmp

    Filesize

    584KB

  • memory/2172-210-0x0000000006410000-0x0000000006486000-memory.dmp

    Filesize

    472KB

  • memory/2172-211-0x00000000064A0000-0x00000000064F0000-memory.dmp

    Filesize

    320KB

  • memory/2172-212-0x0000000007910000-0x0000000007AD2000-memory.dmp

    Filesize

    1.8MB

  • memory/2172-213-0x0000000007AE0000-0x000000000800C000-memory.dmp

    Filesize

    5.2MB

  • memory/2172-220-0x000000000074A000-0x0000000000778000-memory.dmp

    Filesize

    184KB

  • memory/2172-221-0x0000000000400000-0x0000000000477000-memory.dmp

    Filesize

    476KB