Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    72s
  • max time network
    74s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/02/2023, 03:51

General

  • Target

    fb08319c14a5f5d71c3a080b982e5ddc015affc0c2a785a08e932a6eb75f5c06.exe

  • Size

    819KB

  • MD5

    8b879e3bd60681d5c63356bb05c7afe3

  • SHA1

    acc8ca556bc1577db4fd3ad1d0e98b085a4d79e3

  • SHA256

    fb08319c14a5f5d71c3a080b982e5ddc015affc0c2a785a08e932a6eb75f5c06

  • SHA512

    74b9270baec1db5ee67b4f2fba0e7f78dc1cd7f96ca372ccda7f3ecf3dac2408a5d6c32e8979324c0c943d71184281c4bd45f5a3ccc9bedee7c3a360087c201d

  • SSDEEP

    24576:+ygniA8tq+VzCTV5cfhuj5U+EuKbfbFzpjB:Ngn3Y1ChGfha5URDpp

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Extracted

Family

redline

Botnet

ruma

C2

193.233.20.13:4136

Attributes
  • auth_value

    647d00dfaba082a4a30f383bca5d1a2a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb08319c14a5f5d71c3a080b982e5ddc015affc0c2a785a08e932a6eb75f5c06.exe
    "C:\Users\Admin\AppData\Local\Temp\fb08319c14a5f5d71c3a080b982e5ddc015affc0c2a785a08e932a6eb75f5c06.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vOZ1773.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vOZ1773.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4816
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vHm2261.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vHm2261.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1228
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ruJ2588.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ruJ2588.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2760
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sdB1020.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sdB1020.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4720
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tgG54xM.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tgG54xM.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ueK08sK.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ueK08sK.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ueK08sK.exe

    Filesize

    313KB

    MD5

    a5b4394cfdffd55f458ea030a1f959e4

    SHA1

    421a4abb61209bfd6719f402a543c4631a37d16d

    SHA256

    bacbb87f276d71b2b16893b27e9bfca628c425daece9ca998fc811ed8b20ca89

    SHA512

    fc8cd56a0da80945ad291b52799e59dbb15dd3b63c6a0a4daddba1ae81212d5f9fb409b6c0268de416d2e832e7e53bd2f92fe4020e2596c46e530721f5522199

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ueK08sK.exe

    Filesize

    313KB

    MD5

    a5b4394cfdffd55f458ea030a1f959e4

    SHA1

    421a4abb61209bfd6719f402a543c4631a37d16d

    SHA256

    bacbb87f276d71b2b16893b27e9bfca628c425daece9ca998fc811ed8b20ca89

    SHA512

    fc8cd56a0da80945ad291b52799e59dbb15dd3b63c6a0a4daddba1ae81212d5f9fb409b6c0268de416d2e832e7e53bd2f92fe4020e2596c46e530721f5522199

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vOZ1773.exe

    Filesize

    483KB

    MD5

    1f8ce31e31d69c386fee7fd7c8333a07

    SHA1

    f7169b8aa80c8e2fdc1125ca95172041c8053c11

    SHA256

    732202860697fc698400f09dab775289d618c73f15e0b96bda869bde1a76d4b0

    SHA512

    fe53620fabe4ef19ead78ff2018522966e2e71a1f2665af4de3a2b43c3706dc71d7ac3e9e8d2d480c6160cfc9746cafd09a28129365684648b099fee23a09c59

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vOZ1773.exe

    Filesize

    483KB

    MD5

    1f8ce31e31d69c386fee7fd7c8333a07

    SHA1

    f7169b8aa80c8e2fdc1125ca95172041c8053c11

    SHA256

    732202860697fc698400f09dab775289d618c73f15e0b96bda869bde1a76d4b0

    SHA512

    fe53620fabe4ef19ead78ff2018522966e2e71a1f2665af4de3a2b43c3706dc71d7ac3e9e8d2d480c6160cfc9746cafd09a28129365684648b099fee23a09c59

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tgG54xM.exe

    Filesize

    175KB

    MD5

    dd0c9e110c68ce1fa5308979ef718f7b

    SHA1

    473deb8069f0841d47b74b7f414dacc6f96eca78

    SHA256

    dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

    SHA512

    29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tgG54xM.exe

    Filesize

    175KB

    MD5

    dd0c9e110c68ce1fa5308979ef718f7b

    SHA1

    473deb8069f0841d47b74b7f414dacc6f96eca78

    SHA256

    dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

    SHA512

    29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vHm2261.exe

    Filesize

    338KB

    MD5

    c27a045ca7097607b52e5af9822a1748

    SHA1

    b34ba220b352075a4fc077b016be5da08bcf658a

    SHA256

    3aba1388665a333664898789a65fa71fdd540e82036f73b1ccf648926adc7855

    SHA512

    73cf6fbb02dc22758e250b7009e44930efcfe5beaa6efdbffec36f52f04d7453ef8f7a826a4abd9afc41b780bb969276cb3b6d3dde5249039c5fff6ef4977a10

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vHm2261.exe

    Filesize

    338KB

    MD5

    c27a045ca7097607b52e5af9822a1748

    SHA1

    b34ba220b352075a4fc077b016be5da08bcf658a

    SHA256

    3aba1388665a333664898789a65fa71fdd540e82036f73b1ccf648926adc7855

    SHA512

    73cf6fbb02dc22758e250b7009e44930efcfe5beaa6efdbffec36f52f04d7453ef8f7a826a4abd9afc41b780bb969276cb3b6d3dde5249039c5fff6ef4977a10

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ruJ2588.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ruJ2588.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sdB1020.exe

    Filesize

    257KB

    MD5

    813b1f4920c48d60a9252589ffaaf254

    SHA1

    912df3fbb9b0c3c9fe7e29e98ccf06e293204380

    SHA256

    65c7a6312fab0125e333198089d7ea106ef6a369181f1e7e8f8ae95c04c8e8f0

    SHA512

    853845a43d06cd10802c41329b3e8d81d5c9104bd51f47fc56f5634eb2ff079616c5561d5789ba50033a679efdf825a311447abc31e4976f2cf9999efef516c9

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sdB1020.exe

    Filesize

    257KB

    MD5

    813b1f4920c48d60a9252589ffaaf254

    SHA1

    912df3fbb9b0c3c9fe7e29e98ccf06e293204380

    SHA256

    65c7a6312fab0125e333198089d7ea106ef6a369181f1e7e8f8ae95c04c8e8f0

    SHA512

    853845a43d06cd10802c41329b3e8d81d5c9104bd51f47fc56f5634eb2ff079616c5561d5789ba50033a679efdf825a311447abc31e4976f2cf9999efef516c9

  • memory/1184-534-0x0000000000400000-0x0000000000583000-memory.dmp

    Filesize

    1.5MB

  • memory/1184-492-0x0000000002550000-0x0000000002596000-memory.dmp

    Filesize

    280KB

  • memory/1184-497-0x0000000005090000-0x00000000050D4000-memory.dmp

    Filesize

    272KB

  • memory/1184-508-0x00000000007F3000-0x0000000000821000-memory.dmp

    Filesize

    184KB

  • memory/1184-509-0x0000000000590000-0x000000000063E000-memory.dmp

    Filesize

    696KB

  • memory/1184-511-0x0000000000400000-0x0000000000583000-memory.dmp

    Filesize

    1.5MB

  • memory/1184-514-0x00000000059E0000-0x0000000005A2B000-memory.dmp

    Filesize

    300KB

  • memory/1184-528-0x00000000007F3000-0x0000000000821000-memory.dmp

    Filesize

    184KB

  • memory/1184-533-0x00000000007F3000-0x0000000000821000-memory.dmp

    Filesize

    184KB

  • memory/2208-162-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-135-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-145-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-147-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-148-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-146-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-149-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-150-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-151-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-152-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-153-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-154-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-155-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-156-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-157-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-159-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-158-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-160-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-161-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-120-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-163-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-165-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-164-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-143-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-142-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-141-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-140-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-139-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-138-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-137-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-136-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-144-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-134-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-133-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-132-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-131-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-130-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-122-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-121-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-123-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-124-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-125-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-126-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-127-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-129-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2208-128-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/2760-267-0x0000000000B20000-0x0000000000B2A000-memory.dmp

    Filesize

    40KB

  • memory/4164-425-0x0000000006880000-0x00000000068F6000-memory.dmp

    Filesize

    472KB

  • memory/4164-417-0x0000000005680000-0x00000000056E6000-memory.dmp

    Filesize

    408KB

  • memory/4164-414-0x00000000055E0000-0x0000000005672000-memory.dmp

    Filesize

    584KB

  • memory/4164-408-0x0000000005260000-0x000000000529E000-memory.dmp

    Filesize

    248KB

  • memory/4164-410-0x00000000053E0000-0x000000000542B000-memory.dmp

    Filesize

    300KB

  • memory/4164-426-0x0000000006210000-0x0000000006260000-memory.dmp

    Filesize

    320KB

  • memory/4164-406-0x0000000005200000-0x0000000005212000-memory.dmp

    Filesize

    72KB

  • memory/4164-404-0x00000000052D0000-0x00000000053DA000-memory.dmp

    Filesize

    1.0MB

  • memory/4164-403-0x0000000005770000-0x0000000005D76000-memory.dmp

    Filesize

    6.0MB

  • memory/4164-390-0x00000000009A0000-0x00000000009D2000-memory.dmp

    Filesize

    200KB

  • memory/4164-427-0x0000000006BD0000-0x0000000006D92000-memory.dmp

    Filesize

    1.8MB

  • memory/4164-428-0x00000000072D0000-0x00000000077FC000-memory.dmp

    Filesize

    5.2MB

  • memory/4720-338-0x00000000007A3000-0x00000000007C3000-memory.dmp

    Filesize

    128KB

  • memory/4720-339-0x0000000000400000-0x0000000000574000-memory.dmp

    Filesize

    1.5MB

  • memory/4720-336-0x00000000007A3000-0x00000000007C3000-memory.dmp

    Filesize

    128KB

  • memory/4720-333-0x00000000023A0000-0x00000000023B8000-memory.dmp

    Filesize

    96KB

  • memory/4720-331-0x0000000004C20000-0x000000000511E000-memory.dmp

    Filesize

    5.0MB

  • memory/4720-327-0x0000000000760000-0x000000000077A000-memory.dmp

    Filesize

    104KB

  • memory/4720-319-0x0000000000400000-0x0000000000574000-memory.dmp

    Filesize

    1.5MB

  • memory/4720-318-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/4720-317-0x00000000007A3000-0x00000000007C3000-memory.dmp

    Filesize

    128KB

  • memory/4816-184-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-186-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-185-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-179-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-182-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-183-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-181-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-180-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-178-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-177-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-176-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-175-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-173-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-172-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-170-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-171-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-169-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB

  • memory/4816-168-0x0000000077540000-0x00000000776CE000-memory.dmp

    Filesize

    1.6MB