Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/02/2023, 13:17

General

  • Target

    603b3c220a2fc6f1a44fd3454890591b4afa589e391a8856995d7cacae6627d9.exe

  • Size

    336KB

  • MD5

    71c77f5e4bcf35786552a453e04c9d3e

  • SHA1

    8d76bc8e87918693bf1ffed4f3bda1d6af2ec25d

  • SHA256

    603b3c220a2fc6f1a44fd3454890591b4afa589e391a8856995d7cacae6627d9

  • SHA512

    891b2d6e1ed7eb1684f49054088cd3e565ed0d76c94772331736f9ed530e9c856fd5e29306f76cfea0a56ad8c8deedfd584418b35f3899c606031ed46f7cc100

  • SSDEEP

    6144:nbDQmioYCCAYp5fRZOVANlZ1iJ5ZccG7uMR9NX23BoIgPEDZCO4lw1JedPlC:nbDQ7LpDcVAN1lDm3BoIgPEDZCO4lw1H

Malware Config

Extracted

Family

redline

Botnet

24.01

C2

37.220.86.164:29170

Attributes
  • auth_value

    1c7f0aa21138601b5201a3a4a0123991

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\603b3c220a2fc6f1a44fd3454890591b4afa589e391a8856995d7cacae6627d9.exe
    "C:\Users\Admin\AppData\Local\Temp\603b3c220a2fc6f1a44fd3454890591b4afa589e391a8856995d7cacae6627d9.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4112

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4112-120-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-121-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-122-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-124-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-123-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-125-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-126-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-127-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-128-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-129-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-131-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-132-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-130-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-133-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-134-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-135-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-136-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-137-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-138-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-139-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-140-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-142-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-141-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-143-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-144-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-145-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-146-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-147-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-148-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-149-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-150-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-151-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-152-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-153-0x0000000000520000-0x000000000057A000-memory.dmp

    Filesize

    360KB

  • memory/4112-155-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-154-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-156-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-157-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-158-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-159-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-160-0x00000000026B0000-0x00000000026B6000-memory.dmp

    Filesize

    24KB

  • memory/4112-161-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-162-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-163-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-164-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-165-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-166-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-167-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-168-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-169-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-170-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-171-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-172-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-173-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-174-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-175-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-176-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-177-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-178-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-179-0x0000000005450000-0x0000000005A56000-memory.dmp

    Filesize

    6.0MB

  • memory/4112-180-0x0000000004FA0000-0x00000000050AA000-memory.dmp

    Filesize

    1.0MB

  • memory/4112-181-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-182-0x0000000004ED0000-0x0000000004EE2000-memory.dmp

    Filesize

    72KB

  • memory/4112-183-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-184-0x0000000004F30000-0x0000000004F6E000-memory.dmp

    Filesize

    248KB

  • memory/4112-185-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-186-0x00000000050B0000-0x00000000050FB000-memory.dmp

    Filesize

    300KB

  • memory/4112-187-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-188-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-189-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-190-0x0000000005280000-0x0000000005312000-memory.dmp

    Filesize

    584KB

  • memory/4112-191-0x0000000006470000-0x000000000696E000-memory.dmp

    Filesize

    5.0MB

  • memory/4112-192-0x0000000077250000-0x00000000773DE000-memory.dmp

    Filesize

    1.6MB

  • memory/4112-194-0x0000000005A60000-0x0000000005AC6000-memory.dmp

    Filesize

    408KB

  • memory/4112-202-0x0000000006170000-0x00000000061E6000-memory.dmp

    Filesize

    472KB

  • memory/4112-203-0x0000000005DC0000-0x0000000005E10000-memory.dmp

    Filesize

    320KB

  • memory/4112-204-0x0000000006970000-0x0000000006B32000-memory.dmp

    Filesize

    1.8MB

  • memory/4112-205-0x00000000076F0000-0x0000000007C1C000-memory.dmp

    Filesize

    5.2MB