Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/03/2023, 13:32

General

  • Target

    4dad9843e780e46eae518f0d8cfc4f8ec6b8455959f93ecef77bc3c769bc9698.exe

  • Size

    550KB

  • MD5

    ae040c62715a5c3085a38efc1fd02896

  • SHA1

    7cc14b20a768d56f53724d4e7f030e96246e4001

  • SHA256

    4dad9843e780e46eae518f0d8cfc4f8ec6b8455959f93ecef77bc3c769bc9698

  • SHA512

    8df31c65864338c6b98555519812cf56e95de27b7f532c8b0f825efec022fb63f0e34ef2268dd436dfa1c45f44b4f891c9050144bf9b260e561016c5994187e5

  • SSDEEP

    12288:KMryy907uazDQXKMonatNDsUspkBz+MOS+xVI:IyCuanA2ssUajMOBM

Malware Config

Extracted

Family

redline

Botnet

stek

C2

melevv.eu:4162

Attributes
  • auth_value

    4205381daf6946b2df5fe3bc7eacc918

Extracted

Family

redline

Botnet

fomich

C2

melevv.eu:4162

Attributes
  • auth_value

    b018e52ac946001794d8b8c23e901859

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4dad9843e780e46eae518f0d8cfc4f8ec6b8455959f93ecef77bc3c769bc9698.exe
    "C:\Users\Admin\AppData\Local\Temp\4dad9843e780e46eae518f0d8cfc4f8ec6b8455959f93ecef77bc3c769bc9698.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vGA9397HS.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vGA9397HS.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3680
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw91lC54vI56.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw91lC54vI56.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:464
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tdZ17ai06.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tdZ17ai06.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4444
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 1408
          4⤵
          • Program crash
          PID:760
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uGm10Bh13.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uGm10Bh13.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2360
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4444 -ip 4444
    1⤵
      PID:4924
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:3132

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uGm10Bh13.exe

      Filesize

      175KB

      MD5

      b70a0b4de51207e9441c71fc9d49025f

      SHA1

      87eaa29ed5f5f846b04b716d28c9aa9fde1f7264

      SHA256

      b78595bfbbcc9ba42634d512700b68ab3887adc11ce9b790d27b9c11af4a4882

      SHA512

      6019d377056f84571009f47f8922f7945f8a6906643e50be06dea661ac3a443cccb5872d794fb0d3312a1feeb43261a3016f7b18e20294d6bd6c19d75787a410

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uGm10Bh13.exe

      Filesize

      175KB

      MD5

      b70a0b4de51207e9441c71fc9d49025f

      SHA1

      87eaa29ed5f5f846b04b716d28c9aa9fde1f7264

      SHA256

      b78595bfbbcc9ba42634d512700b68ab3887adc11ce9b790d27b9c11af4a4882

      SHA512

      6019d377056f84571009f47f8922f7945f8a6906643e50be06dea661ac3a443cccb5872d794fb0d3312a1feeb43261a3016f7b18e20294d6bd6c19d75787a410

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vGA9397HS.exe

      Filesize

      405KB

      MD5

      40bb3a00cadc7be7602f61139614a214

      SHA1

      2a46e04a49ca36319a9f307be3f10994a30984ac

      SHA256

      f5ca7b108877138d19f36029fdb806941cc7238cd78cb842b36500a9448dc675

      SHA512

      33edfc2ac4d1ed8702d4c8b7c4fbfc6d6159b59f814f1bc501a65d9ce5676d892a9d5fc15bc58a477c65f4afd5a7bdccadfb55edc548b055b4010b29f22755fd

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vGA9397HS.exe

      Filesize

      405KB

      MD5

      40bb3a00cadc7be7602f61139614a214

      SHA1

      2a46e04a49ca36319a9f307be3f10994a30984ac

      SHA256

      f5ca7b108877138d19f36029fdb806941cc7238cd78cb842b36500a9448dc675

      SHA512

      33edfc2ac4d1ed8702d4c8b7c4fbfc6d6159b59f814f1bc501a65d9ce5676d892a9d5fc15bc58a477c65f4afd5a7bdccadfb55edc548b055b4010b29f22755fd

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw91lC54vI56.exe

      Filesize

      17KB

      MD5

      c6307f2b9593977dd852cab6bec1d549

      SHA1

      6a74543f09f76c7dcacbdecf53ac0efea5e6edf6

      SHA256

      2281613e348b8b63544c36cc84ce0dbad5eedc83f3a668f42fd67d02eb38297b

      SHA512

      25fe6fc1a910804d15fef96cc494597a2bf1798805ea21ca4be756e4883d014c1d9b949ffef13b973e9fbc1b1136d60d4826a942a151c43e79831fac75de98d0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw91lC54vI56.exe

      Filesize

      17KB

      MD5

      c6307f2b9593977dd852cab6bec1d549

      SHA1

      6a74543f09f76c7dcacbdecf53ac0efea5e6edf6

      SHA256

      2281613e348b8b63544c36cc84ce0dbad5eedc83f3a668f42fd67d02eb38297b

      SHA512

      25fe6fc1a910804d15fef96cc494597a2bf1798805ea21ca4be756e4883d014c1d9b949ffef13b973e9fbc1b1136d60d4826a942a151c43e79831fac75de98d0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tdZ17ai06.exe

      Filesize

      387KB

      MD5

      114729e73998f8b36384a7c4cadcf3b0

      SHA1

      aca4ea52bbd204fa016311eb5e1f6ef9770f2362

      SHA256

      dbeeca1aaeaa247cb4a672c8741e578a235817831a080ce894a08d71a1bbb7fa

      SHA512

      4044a648270d77f84c822346d483fa32a39c24b3088a874a4d9e53584ed228e1a67c4c10654eb20209dc48339308d65c5c8bde33f26eb6e5d0741f354f24cc44

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tdZ17ai06.exe

      Filesize

      387KB

      MD5

      114729e73998f8b36384a7c4cadcf3b0

      SHA1

      aca4ea52bbd204fa016311eb5e1f6ef9770f2362

      SHA256

      dbeeca1aaeaa247cb4a672c8741e578a235817831a080ce894a08d71a1bbb7fa

      SHA512

      4044a648270d77f84c822346d483fa32a39c24b3088a874a4d9e53584ed228e1a67c4c10654eb20209dc48339308d65c5c8bde33f26eb6e5d0741f354f24cc44

    • memory/464-147-0x0000000000EF0000-0x0000000000EFA000-memory.dmp

      Filesize

      40KB

    • memory/2360-1085-0x00000000004E0000-0x0000000000512000-memory.dmp

      Filesize

      200KB

    • memory/2360-1086-0x0000000005110000-0x0000000005120000-memory.dmp

      Filesize

      64KB

    • memory/4444-189-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-201-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-155-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-156-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-157-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-158-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-159-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-161-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-163-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-165-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-167-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-169-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-171-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-173-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-175-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-177-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-179-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-181-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-183-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-185-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-187-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-153-0x00000000072A0000-0x0000000007844000-memory.dmp

      Filesize

      5.6MB

    • memory/4444-191-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-193-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-195-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-197-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-199-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-154-0x0000000002CA0000-0x0000000002CEB000-memory.dmp

      Filesize

      300KB

    • memory/4444-203-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-205-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-207-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-211-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-209-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-213-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-215-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-217-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-219-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-221-0x00000000071D0000-0x000000000720E000-memory.dmp

      Filesize

      248KB

    • memory/4444-1064-0x0000000007850000-0x0000000007E68000-memory.dmp

      Filesize

      6.1MB

    • memory/4444-1065-0x0000000007E70000-0x0000000007F7A000-memory.dmp

      Filesize

      1.0MB

    • memory/4444-1066-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

      Filesize

      72KB

    • memory/4444-1067-0x0000000007FD0000-0x000000000800C000-memory.dmp

      Filesize

      240KB

    • memory/4444-1068-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-1070-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-1071-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-1072-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB

    • memory/4444-1073-0x00000000082D0000-0x0000000008362000-memory.dmp

      Filesize

      584KB

    • memory/4444-1074-0x0000000008370000-0x00000000083D6000-memory.dmp

      Filesize

      408KB

    • memory/4444-1075-0x0000000008A70000-0x0000000008AE6000-memory.dmp

      Filesize

      472KB

    • memory/4444-1076-0x0000000008AF0000-0x0000000008B40000-memory.dmp

      Filesize

      320KB

    • memory/4444-1077-0x0000000008B70000-0x0000000008D32000-memory.dmp

      Filesize

      1.8MB

    • memory/4444-1078-0x0000000008D40000-0x000000000926C000-memory.dmp

      Filesize

      5.2MB

    • memory/4444-1079-0x0000000007290000-0x00000000072A0000-memory.dmp

      Filesize

      64KB