Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2023, 16:30

General

  • Target

    fe4c0883eba2c1f26dd638142a5c6f9d.exe

  • Size

    468KB

  • MD5

    fe4c0883eba2c1f26dd638142a5c6f9d

  • SHA1

    6417d8b40c8737d4219a2978d757724c8d5ee06f

  • SHA256

    2e94a777e3b86474913bb95e457207c645956b53f41a39149418d806be8a6aa1

  • SHA512

    37c72eaccd5352722c274e45413f4079f59cc965de867e82892087a74aabb5ee3edd5c4ff0d8913c8ce79c3e6c488b5f08a6a90a94139b89e8bea80f1b15ae90

  • SSDEEP

    6144:Kny+bnr+Cp0yN90QEfcIUP0LVPIkYFsmPBcLslftc1xUMThp1yc60+hc5Hur92zB:VMr+y90VZUMLVoGmPlftcnpKfF9FTK

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Extracted

Family

redline

Botnet

cr10n

C2

176.113.115.17:4132

Attributes
  • auth_value

    6016c19179aa1044c369adb0ec1f363b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe4c0883eba2c1f26dd638142a5c6f9d.exe
    "C:\Users\Admin\AppData\Local\Temp\fe4c0883eba2c1f26dd638142a5c6f9d.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ndO54.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ndO54.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bot56.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bot56.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1712
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\coB01Eu.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\coB01Eu.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1672
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1324

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe

    Filesize

    220KB

    MD5

    de42ca5e48e76be8fc7fd36752b6eb50

    SHA1

    c594fea49882a1f0c4745c38de903c8f3e963acd

    SHA256

    9be125a22fe4bbedcd63b46faf563f107bb54c1f6c894e45b4794c3e184aa0aa

    SHA512

    b4dbe8b6ed6cf26a7225ef2a8af07629fdcc447920dd8bb5362cefdbbafe439ef92e5011c8c26716dba06646d161eca676470e484995173dd39dc42db454ff7b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe

    Filesize

    220KB

    MD5

    de42ca5e48e76be8fc7fd36752b6eb50

    SHA1

    c594fea49882a1f0c4745c38de903c8f3e963acd

    SHA256

    9be125a22fe4bbedcd63b46faf563f107bb54c1f6c894e45b4794c3e184aa0aa

    SHA512

    b4dbe8b6ed6cf26a7225ef2a8af07629fdcc447920dd8bb5362cefdbbafe439ef92e5011c8c26716dba06646d161eca676470e484995173dd39dc42db454ff7b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ndO54.exe

    Filesize

    202KB

    MD5

    feeaf18fafd2b343ae4f71234552cf28

    SHA1

    dfdc687e0d79e24da5c029e4dab92b5af9fcbaa2

    SHA256

    18da39c88089c62e15abfacd6ab592769108775268d4be2751478629774e2c14

    SHA512

    d1a51bbbb040920943b74c59aafd9bdf925db31cd63fa0fde3b9e9fad8ec55e6856e1b857c926a076f968f13fcc36d642c30ac2e2d7a24b1c7ee882e58cb8eb7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ndO54.exe

    Filesize

    202KB

    MD5

    feeaf18fafd2b343ae4f71234552cf28

    SHA1

    dfdc687e0d79e24da5c029e4dab92b5af9fcbaa2

    SHA256

    18da39c88089c62e15abfacd6ab592769108775268d4be2751478629774e2c14

    SHA512

    d1a51bbbb040920943b74c59aafd9bdf925db31cd63fa0fde3b9e9fad8ec55e6856e1b857c926a076f968f13fcc36d642c30ac2e2d7a24b1c7ee882e58cb8eb7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bot56.exe

    Filesize

    175KB

    MD5

    a5f5c5d6291c7ae9e1d1b7ed1e551490

    SHA1

    3d06413341893b838549939e15f8f1eec423d71a

    SHA256

    1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

    SHA512

    d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bot56.exe

    Filesize

    175KB

    MD5

    a5f5c5d6291c7ae9e1d1b7ed1e551490

    SHA1

    3d06413341893b838549939e15f8f1eec423d71a

    SHA256

    1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

    SHA512

    d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\coB01Eu.exe

    Filesize

    175KB

    MD5

    ce5ef6aac94fdb2af40da676f6cab58f

    SHA1

    c393f24b1550955a686ee39067f20813415af95f

    SHA256

    ce360295ca7fcc1a1c2b47a604305c67ab41358770edbd769a6a44aa635c2fd0

    SHA512

    2cc98869cba6a962129c57fb7e3ff0b64623c94903bfbf9a2648e191b633fbe73f8e7b9d8fea348e30cc88bc44d27454fd880c81a55a6b795170fa804e6cda65

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\coB01Eu.exe

    Filesize

    175KB

    MD5

    ce5ef6aac94fdb2af40da676f6cab58f

    SHA1

    c393f24b1550955a686ee39067f20813415af95f

    SHA256

    ce360295ca7fcc1a1c2b47a604305c67ab41358770edbd769a6a44aa635c2fd0

    SHA512

    2cc98869cba6a962129c57fb7e3ff0b64623c94903bfbf9a2648e191b633fbe73f8e7b9d8fea348e30cc88bc44d27454fd880c81a55a6b795170fa804e6cda65

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe

    Filesize

    220KB

    MD5

    de42ca5e48e76be8fc7fd36752b6eb50

    SHA1

    c594fea49882a1f0c4745c38de903c8f3e963acd

    SHA256

    9be125a22fe4bbedcd63b46faf563f107bb54c1f6c894e45b4794c3e184aa0aa

    SHA512

    b4dbe8b6ed6cf26a7225ef2a8af07629fdcc447920dd8bb5362cefdbbafe439ef92e5011c8c26716dba06646d161eca676470e484995173dd39dc42db454ff7b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe

    Filesize

    220KB

    MD5

    de42ca5e48e76be8fc7fd36752b6eb50

    SHA1

    c594fea49882a1f0c4745c38de903c8f3e963acd

    SHA256

    9be125a22fe4bbedcd63b46faf563f107bb54c1f6c894e45b4794c3e184aa0aa

    SHA512

    b4dbe8b6ed6cf26a7225ef2a8af07629fdcc447920dd8bb5362cefdbbafe439ef92e5011c8c26716dba06646d161eca676470e484995173dd39dc42db454ff7b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\dqW66.exe

    Filesize

    220KB

    MD5

    de42ca5e48e76be8fc7fd36752b6eb50

    SHA1

    c594fea49882a1f0c4745c38de903c8f3e963acd

    SHA256

    9be125a22fe4bbedcd63b46faf563f107bb54c1f6c894e45b4794c3e184aa0aa

    SHA512

    b4dbe8b6ed6cf26a7225ef2a8af07629fdcc447920dd8bb5362cefdbbafe439ef92e5011c8c26716dba06646d161eca676470e484995173dd39dc42db454ff7b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ndO54.exe

    Filesize

    202KB

    MD5

    feeaf18fafd2b343ae4f71234552cf28

    SHA1

    dfdc687e0d79e24da5c029e4dab92b5af9fcbaa2

    SHA256

    18da39c88089c62e15abfacd6ab592769108775268d4be2751478629774e2c14

    SHA512

    d1a51bbbb040920943b74c59aafd9bdf925db31cd63fa0fde3b9e9fad8ec55e6856e1b857c926a076f968f13fcc36d642c30ac2e2d7a24b1c7ee882e58cb8eb7

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ndO54.exe

    Filesize

    202KB

    MD5

    feeaf18fafd2b343ae4f71234552cf28

    SHA1

    dfdc687e0d79e24da5c029e4dab92b5af9fcbaa2

    SHA256

    18da39c88089c62e15abfacd6ab592769108775268d4be2751478629774e2c14

    SHA512

    d1a51bbbb040920943b74c59aafd9bdf925db31cd63fa0fde3b9e9fad8ec55e6856e1b857c926a076f968f13fcc36d642c30ac2e2d7a24b1c7ee882e58cb8eb7

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bot56.exe

    Filesize

    175KB

    MD5

    a5f5c5d6291c7ae9e1d1b7ed1e551490

    SHA1

    3d06413341893b838549939e15f8f1eec423d71a

    SHA256

    1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

    SHA512

    d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\bot56.exe

    Filesize

    175KB

    MD5

    a5f5c5d6291c7ae9e1d1b7ed1e551490

    SHA1

    3d06413341893b838549939e15f8f1eec423d71a

    SHA256

    1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

    SHA512

    d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\coB01Eu.exe

    Filesize

    175KB

    MD5

    ce5ef6aac94fdb2af40da676f6cab58f

    SHA1

    c393f24b1550955a686ee39067f20813415af95f

    SHA256

    ce360295ca7fcc1a1c2b47a604305c67ab41358770edbd769a6a44aa635c2fd0

    SHA512

    2cc98869cba6a962129c57fb7e3ff0b64623c94903bfbf9a2648e191b633fbe73f8e7b9d8fea348e30cc88bc44d27454fd880c81a55a6b795170fa804e6cda65

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\coB01Eu.exe

    Filesize

    175KB

    MD5

    ce5ef6aac94fdb2af40da676f6cab58f

    SHA1

    c393f24b1550955a686ee39067f20813415af95f

    SHA256

    ce360295ca7fcc1a1c2b47a604305c67ab41358770edbd769a6a44aa635c2fd0

    SHA512

    2cc98869cba6a962129c57fb7e3ff0b64623c94903bfbf9a2648e191b633fbe73f8e7b9d8fea348e30cc88bc44d27454fd880c81a55a6b795170fa804e6cda65

  • memory/832-54-0x0000000075291000-0x0000000075293000-memory.dmp

    Filesize

    8KB

  • memory/1324-82-0x0000000002370000-0x000000000238A000-memory.dmp

    Filesize

    104KB

  • memory/1324-83-0x0000000002480000-0x0000000002498000-memory.dmp

    Filesize

    96KB

  • memory/1324-84-0x000000000089F000-0x00000000008BF000-memory.dmp

    Filesize

    128KB

  • memory/1324-85-0x0000000000240000-0x000000000026D000-memory.dmp

    Filesize

    180KB

  • memory/1324-86-0x0000000000400000-0x0000000000754000-memory.dmp

    Filesize

    3.3MB

  • memory/1324-87-0x000000000089F000-0x00000000008BF000-memory.dmp

    Filesize

    128KB

  • memory/1324-88-0x0000000000400000-0x0000000000754000-memory.dmp

    Filesize

    3.3MB

  • memory/1672-74-0x0000000000E50000-0x0000000000E82000-memory.dmp

    Filesize

    200KB

  • memory/1712-67-0x0000000001100000-0x0000000001132000-memory.dmp

    Filesize

    200KB