Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    79s
  • max time network
    81s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/03/2023, 20:19

General

  • Target

    2b085ed167b51549a426eb9c8f5b940fe2f95881c119bbdeffea7cee97decb37.exe

  • Size

    686KB

  • MD5

    108e6ae0e620ef33aad48a6597f727d7

  • SHA1

    397e20b0d01a5b88c46856c0635cc61f7b47b1c8

  • SHA256

    2b085ed167b51549a426eb9c8f5b940fe2f95881c119bbdeffea7cee97decb37

  • SHA512

    b307a575547d8b1aab0787c71df3bf0c569aebe4d6c5c3e81d82d779d010c31c00b45e24b57634280c738604966a0f215fbc0c65d2229a7ce6b57c503d3db622

  • SSDEEP

    12288:UMrly90jcNVyhhtv5kfED+AEE6d8BnsFrA+Z/EBAxX+lGl+FJTIW:RyyMVynp5k8D7EE6knQ7WWxOlGl/W

Malware Config

Extracted

Family

redline

Botnet

stek

C2

melevv.eu:4162

Attributes
  • auth_value

    4205381daf6946b2df5fe3bc7eacc918

Extracted

Family

redline

Botnet

fomich

C2

melevv.eu:4162

Attributes
  • auth_value

    b018e52ac946001794d8b8c23e901859

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b085ed167b51549a426eb9c8f5b940fe2f95881c119bbdeffea7cee97decb37.exe
    "C:\Users\Admin\AppData\Local\Temp\2b085ed167b51549a426eb9c8f5b940fe2f95881c119bbdeffea7cee97decb37.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4092
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMD20br58.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMD20br58.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5052
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urpd85nO72.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urpd85nO72.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:824
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrbm57wk97.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrbm57wk97.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4980
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xunQ73rn87.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xunQ73rn87.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3464

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xunQ73rn87.exe

    Filesize

    175KB

    MD5

    7efff3d40fdb45923e6e8c292cea7624

    SHA1

    daee92533af187658d3378e9ed666aa8eab00c12

    SHA256

    6d16f1bea1579225e6faa7c279fe16226f606039f6667c0be005fc46432f68e6

    SHA512

    8fc8ae543e50d434c4a4632629c0ceb3d527058bd341ab890a954c28d0d1df13611d97c0827bb5b7bfa2730c54b18245bd5cd3b0ef6ce23267f88f528531bdf9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xunQ73rn87.exe

    Filesize

    175KB

    MD5

    7efff3d40fdb45923e6e8c292cea7624

    SHA1

    daee92533af187658d3378e9ed666aa8eab00c12

    SHA256

    6d16f1bea1579225e6faa7c279fe16226f606039f6667c0be005fc46432f68e6

    SHA512

    8fc8ae543e50d434c4a4632629c0ceb3d527058bd341ab890a954c28d0d1df13611d97c0827bb5b7bfa2730c54b18245bd5cd3b0ef6ce23267f88f528531bdf9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMD20br58.exe

    Filesize

    542KB

    MD5

    808fb7d3f175bdba2dae98aed86191a5

    SHA1

    44d5b0cc25dd31e7f2ccf893738c648bf5336d7f

    SHA256

    9a960f1a306bfa273d1861dc5c17522650ab02f6d5e398e295454aabf069d97d

    SHA512

    01ab1c4ba31b0627d39a0a94fb69c9800777be908b7b8c04ff8b3e14dc625d827c0dee52a9e5341a26acee7529dde7591e676bd8650175fd0228bd5b2d472f3e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMD20br58.exe

    Filesize

    542KB

    MD5

    808fb7d3f175bdba2dae98aed86191a5

    SHA1

    44d5b0cc25dd31e7f2ccf893738c648bf5336d7f

    SHA256

    9a960f1a306bfa273d1861dc5c17522650ab02f6d5e398e295454aabf069d97d

    SHA512

    01ab1c4ba31b0627d39a0a94fb69c9800777be908b7b8c04ff8b3e14dc625d827c0dee52a9e5341a26acee7529dde7591e676bd8650175fd0228bd5b2d472f3e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urpd85nO72.exe

    Filesize

    318KB

    MD5

    6bf70eb1f13bb5f9dc61eef7d7016664

    SHA1

    704a3f23de746bf164ca205f1b03a9ee2c752877

    SHA256

    e11eb0b06cc9a208a2de0a01f190bfae2f0484e84a68a4d822731c9bc92abce0

    SHA512

    2846e76f2ac6cfa272c87e77bd5579133585654e5c1725aaf471209d04ff6749a4ab02f4180a66af637cba0e6a5468bce0a957ff1ac7d8a0f1698fa12f750b4f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\urpd85nO72.exe

    Filesize

    318KB

    MD5

    6bf70eb1f13bb5f9dc61eef7d7016664

    SHA1

    704a3f23de746bf164ca205f1b03a9ee2c752877

    SHA256

    e11eb0b06cc9a208a2de0a01f190bfae2f0484e84a68a4d822731c9bc92abce0

    SHA512

    2846e76f2ac6cfa272c87e77bd5579133585654e5c1725aaf471209d04ff6749a4ab02f4180a66af637cba0e6a5468bce0a957ff1ac7d8a0f1698fa12f750b4f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrbm57wk97.exe

    Filesize

    376KB

    MD5

    d59f82338e5d937f8762de73d2fe5bfd

    SHA1

    405e65a38c7677eaed8a28a9b9ef72a0ad7bdacb

    SHA256

    138b6143c345a24a8f866d24f461d19ce4c9ed06204f12eb4d09207baff6ebf1

    SHA512

    bf1cfe667b92ecdfd20625a50245e2640ddcc7f0320ae842b28ebd9e48582a437ed68360745d997d0cb5064926b84ec7de4450bf9f3d89692ea5f1ddf4775e75

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\wrbm57wk97.exe

    Filesize

    376KB

    MD5

    d59f82338e5d937f8762de73d2fe5bfd

    SHA1

    405e65a38c7677eaed8a28a9b9ef72a0ad7bdacb

    SHA256

    138b6143c345a24a8f866d24f461d19ce4c9ed06204f12eb4d09207baff6ebf1

    SHA512

    bf1cfe667b92ecdfd20625a50245e2640ddcc7f0320ae842b28ebd9e48582a437ed68360745d997d0cb5064926b84ec7de4450bf9f3d89692ea5f1ddf4775e75

  • memory/824-133-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/824-134-0x00000000047D0000-0x00000000047EA000-memory.dmp

    Filesize

    104KB

  • memory/824-135-0x0000000007210000-0x000000000770E000-memory.dmp

    Filesize

    5.0MB

  • memory/824-136-0x00000000049A0000-0x00000000049B8000-memory.dmp

    Filesize

    96KB

  • memory/824-137-0x0000000007200000-0x0000000007210000-memory.dmp

    Filesize

    64KB

  • memory/824-138-0x0000000007200000-0x0000000007210000-memory.dmp

    Filesize

    64KB

  • memory/824-139-0x0000000007200000-0x0000000007210000-memory.dmp

    Filesize

    64KB

  • memory/824-140-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-141-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-143-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-145-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-147-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-149-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-151-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-153-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-155-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-157-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-159-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-161-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-163-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-165-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-167-0x00000000049A0000-0x00000000049B2000-memory.dmp

    Filesize

    72KB

  • memory/824-168-0x0000000000400000-0x0000000002BBD000-memory.dmp

    Filesize

    39.7MB

  • memory/824-169-0x0000000007200000-0x0000000007210000-memory.dmp

    Filesize

    64KB

  • memory/824-171-0x0000000000400000-0x0000000002BBD000-memory.dmp

    Filesize

    39.7MB

  • memory/3464-1114-0x00000000001B0000-0x00000000001E2000-memory.dmp

    Filesize

    200KB

  • memory/3464-1116-0x0000000004D80000-0x0000000004D90000-memory.dmp

    Filesize

    64KB

  • memory/3464-1115-0x0000000004BF0000-0x0000000004C3B000-memory.dmp

    Filesize

    300KB

  • memory/4980-179-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-211-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-178-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-183-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-184-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-182-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-186-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-187-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-191-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-189-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-193-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-195-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-197-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-199-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-201-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-203-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-205-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-207-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-209-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-180-0x0000000002BD0000-0x0000000002C1B000-memory.dmp

    Filesize

    300KB

  • memory/4980-213-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-215-0x0000000004B10000-0x0000000004B4E000-memory.dmp

    Filesize

    248KB

  • memory/4980-1088-0x0000000007DA0000-0x00000000083A6000-memory.dmp

    Filesize

    6.0MB

  • memory/4980-1089-0x0000000007790000-0x000000000789A000-memory.dmp

    Filesize

    1.0MB

  • memory/4980-1090-0x00000000078A0000-0x00000000078B2000-memory.dmp

    Filesize

    72KB

  • memory/4980-1091-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-1092-0x00000000078C0000-0x00000000078FE000-memory.dmp

    Filesize

    248KB

  • memory/4980-1093-0x0000000007A10000-0x0000000007A5B000-memory.dmp

    Filesize

    300KB

  • memory/4980-1095-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-1096-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-1097-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-1098-0x0000000007BB0000-0x0000000007C16000-memory.dmp

    Filesize

    408KB

  • memory/4980-1099-0x0000000008890000-0x0000000008922000-memory.dmp

    Filesize

    584KB

  • memory/4980-1100-0x0000000008950000-0x0000000008B12000-memory.dmp

    Filesize

    1.8MB

  • memory/4980-1101-0x0000000008B30000-0x000000000905C000-memory.dmp

    Filesize

    5.2MB

  • memory/4980-177-0x0000000004B10000-0x0000000004B54000-memory.dmp

    Filesize

    272KB

  • memory/4980-176-0x0000000002FC0000-0x0000000003006000-memory.dmp

    Filesize

    280KB

  • memory/4980-1102-0x0000000004B00000-0x0000000004B10000-memory.dmp

    Filesize

    64KB

  • memory/4980-1103-0x0000000009510000-0x0000000009586000-memory.dmp

    Filesize

    472KB

  • memory/4980-1104-0x0000000009590000-0x00000000095E0000-memory.dmp

    Filesize

    320KB