Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2023, 03:39

General

  • Target

    7f1ac9f2294fc9813e584fd30023938a79fdb6edc3b7fd1210033c2291cd8334.exe

  • Size

    537KB

  • MD5

    d19cb4d655e04728642cf71c7b3b65a6

  • SHA1

    72830dc74c4899c29fc37b507bc895192bd7e9fd

  • SHA256

    7f1ac9f2294fc9813e584fd30023938a79fdb6edc3b7fd1210033c2291cd8334

  • SHA512

    bbc74da06c207de18be3760136f78335816be0a26a2218798a8abe37c3e0c82368a499b8e9b802b03c2339dd782b049a5feca97da8c1e18dfac89b8d1edc0ecc

  • SSDEEP

    12288:EMrVy90YfbJbp4rZhCPP7gHYN6L1w3HRTK3XvVMPNFY2OMVQs:hyJftt4VhC37g4N6L1OdYX9M3Y2OQP

Malware Config

Extracted

Family

redline

Botnet

rouch

C2

193.56.146.11:4162

Attributes
  • auth_value

    1b1735bcfc122c708eae27ca352568de

Extracted

Family

redline

Botnet

fuba

C2

193.56.146.11:4162

Attributes
  • auth_value

    43015841fc23c63b15ca6ffe1d278d5e

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f1ac9f2294fc9813e584fd30023938a79fdb6edc3b7fd1210033c2291cd8334.exe
    "C:\Users\Admin\AppData\Local\Temp\7f1ac9f2294fc9813e584fd30023938a79fdb6edc3b7fd1210033c2291cd8334.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSg6705mn.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSg6705mn.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11gE19VH87.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11gE19VH87.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3900
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\teN05wI51.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\teN05wI51.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3992
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\urZ50SE04.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\urZ50SE04.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\urZ50SE04.exe

    Filesize

    175KB

    MD5

    6ee553b0c79b6351a21ed8fb41ca02cf

    SHA1

    19924bf3facde5eb2bf0c9b4b930a27a4b2767f9

    SHA256

    49251cc83c865b9b6f4cdbe8b7e913780ee04aa8135941ab83a03e2a09fb2acb

    SHA512

    6936724b90e5e24dd0bc3fca1d0dc0d1c290eb5ae7680b7aaf38b0d05cd1c5911714dd9e97cb9445bc55c6c8a27233580e81f985a83a229303731615c789a280

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\urZ50SE04.exe

    Filesize

    175KB

    MD5

    6ee553b0c79b6351a21ed8fb41ca02cf

    SHA1

    19924bf3facde5eb2bf0c9b4b930a27a4b2767f9

    SHA256

    49251cc83c865b9b6f4cdbe8b7e913780ee04aa8135941ab83a03e2a09fb2acb

    SHA512

    6936724b90e5e24dd0bc3fca1d0dc0d1c290eb5ae7680b7aaf38b0d05cd1c5911714dd9e97cb9445bc55c6c8a27233580e81f985a83a229303731615c789a280

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSg6705mn.exe

    Filesize

    391KB

    MD5

    30ace2968d3075b2ca6f1ba146ce0f62

    SHA1

    5125a09ccdd1c0d7e21011388e9f04a8799c42fc

    SHA256

    00419880055ef06dd9e12e747d834a5863f7e3545dd1e5d4c0e0a09a26c6fe92

    SHA512

    034ec739cddb37e7e5a82407da8c4b65ad570519986f6d978f22594c79541d379304717754fac53e5cfcda719807d8b0c5f2ce54185df2733fb58f7712d63970

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vSg6705mn.exe

    Filesize

    391KB

    MD5

    30ace2968d3075b2ca6f1ba146ce0f62

    SHA1

    5125a09ccdd1c0d7e21011388e9f04a8799c42fc

    SHA256

    00419880055ef06dd9e12e747d834a5863f7e3545dd1e5d4c0e0a09a26c6fe92

    SHA512

    034ec739cddb37e7e5a82407da8c4b65ad570519986f6d978f22594c79541d379304717754fac53e5cfcda719807d8b0c5f2ce54185df2733fb58f7712d63970

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11gE19VH87.exe

    Filesize

    12KB

    MD5

    ca741b6166fc749f650a840ce47d0508

    SHA1

    f8eb79b1c1e17f42fc6c5e94a4c2566a9c896260

    SHA256

    ae0a3764f02092fdf14c29d4be07556411af9281f8dc80f7c782a540941f588f

    SHA512

    2116aa3b640e5c22e6736dc5b94ec31c0873eee5f4569d5aa5e0fffd53f2b93a031c516fc48b5368665f977aea39ec2f9c1a6037b3e7bdce6ad111b46335b3da

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw11gE19VH87.exe

    Filesize

    12KB

    MD5

    ca741b6166fc749f650a840ce47d0508

    SHA1

    f8eb79b1c1e17f42fc6c5e94a4c2566a9c896260

    SHA256

    ae0a3764f02092fdf14c29d4be07556411af9281f8dc80f7c782a540941f588f

    SHA512

    2116aa3b640e5c22e6736dc5b94ec31c0873eee5f4569d5aa5e0fffd53f2b93a031c516fc48b5368665f977aea39ec2f9c1a6037b3e7bdce6ad111b46335b3da

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\teN05wI51.exe

    Filesize

    304KB

    MD5

    6940451e769c094029427d1531775121

    SHA1

    03c763ca8ebc6896fb35c9f8d4d3fc64d03fe850

    SHA256

    ab9bbcc3bb273a1f13db7566032205b26f5a4a634194ba39007349aa34801dca

    SHA512

    53578c0693e6a171feec767f38f4601da453875d14a37f82e3ca30cce3b7217d4b5b0a6de659d54d11810ee238bd5816d2bc9635cf20dcd9f73901a09c08ff06

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\teN05wI51.exe

    Filesize

    304KB

    MD5

    6940451e769c094029427d1531775121

    SHA1

    03c763ca8ebc6896fb35c9f8d4d3fc64d03fe850

    SHA256

    ab9bbcc3bb273a1f13db7566032205b26f5a4a634194ba39007349aa34801dca

    SHA512

    53578c0693e6a171feec767f38f4601da453875d14a37f82e3ca30cce3b7217d4b5b0a6de659d54d11810ee238bd5816d2bc9635cf20dcd9f73901a09c08ff06

  • memory/3900-147-0x0000000000470000-0x000000000047A000-memory.dmp

    Filesize

    40KB

  • memory/3992-153-0x0000000000710000-0x000000000075B000-memory.dmp

    Filesize

    300KB

  • memory/3992-154-0x0000000004C10000-0x0000000004C20000-memory.dmp

    Filesize

    64KB

  • memory/3992-155-0x0000000004C20000-0x00000000051C4000-memory.dmp

    Filesize

    5.6MB

  • memory/3992-156-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-161-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-159-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-157-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-165-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-163-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-167-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-169-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-171-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-173-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-175-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-177-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-181-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-179-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-185-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-183-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-187-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-189-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-191-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-193-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-203-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-205-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-201-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-199-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-209-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-213-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-211-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-207-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-197-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-215-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-219-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-217-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-195-0x0000000004B60000-0x0000000004B9E000-memory.dmp

    Filesize

    248KB

  • memory/3992-1062-0x00000000051D0000-0x00000000057E8000-memory.dmp

    Filesize

    6.1MB

  • memory/3992-1063-0x0000000005830000-0x000000000593A000-memory.dmp

    Filesize

    1.0MB

  • memory/3992-1064-0x0000000005970000-0x0000000005982000-memory.dmp

    Filesize

    72KB

  • memory/3992-1065-0x0000000005990000-0x00000000059CC000-memory.dmp

    Filesize

    240KB

  • memory/3992-1066-0x0000000004C10000-0x0000000004C20000-memory.dmp

    Filesize

    64KB

  • memory/3992-1068-0x0000000005C80000-0x0000000005CE6000-memory.dmp

    Filesize

    408KB

  • memory/3992-1069-0x0000000006340000-0x00000000063D2000-memory.dmp

    Filesize

    584KB

  • memory/3992-1070-0x0000000006450000-0x0000000006612000-memory.dmp

    Filesize

    1.8MB

  • memory/3992-1071-0x0000000006620000-0x0000000006B4C000-memory.dmp

    Filesize

    5.2MB

  • memory/3992-1072-0x0000000006DB0000-0x0000000006E26000-memory.dmp

    Filesize

    472KB

  • memory/3992-1073-0x0000000006E40000-0x0000000006E90000-memory.dmp

    Filesize

    320KB

  • memory/3992-1074-0x0000000004C10000-0x0000000004C20000-memory.dmp

    Filesize

    64KB

  • memory/4000-1080-0x0000000000250000-0x0000000000282000-memory.dmp

    Filesize

    200KB

  • memory/4000-1081-0x0000000004E20000-0x0000000004E30000-memory.dmp

    Filesize

    64KB