Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/03/2023, 00:38

General

  • Target

    57a7a1843876f34f2b03259d36107b61519d9d115637d4df4adaaae0e2ba7d43.exe

  • Size

    555KB

  • MD5

    e5384d2cb4f371feac94919c996ca6da

  • SHA1

    5e9d085bab7f60b2f3abdd42d52ba30cbcff461a

  • SHA256

    57a7a1843876f34f2b03259d36107b61519d9d115637d4df4adaaae0e2ba7d43

  • SHA512

    8ee9a161e1ee52fea641bcd7355f622f217c0b41175b2e48052bdb4dc9938536fb0e65e7a8456ab7bf5775bce3b8c48da942bc4dadb3207878ac4e9c516dd783

  • SSDEEP

    12288:GMroy90bX8bUVuPtkKHtAL/81sHGsdrsg+INUSF+x9TrC5:Gy+VotkStAA1s9F+5SITu5

Malware Config

Extracted

Family

redline

Botnet

ruzhpe

C2

pepunn.com:4162

Attributes
  • auth_value

    f735ced96ae8d01d0bd1d514240e54e0

Extracted

Family

redline

Botnet

fchan

C2

pepunn.com:4162

Attributes
  • auth_value

    127bd53d55e8c4f0dd2f6e1ea60deef4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 34 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\57a7a1843876f34f2b03259d36107b61519d9d115637d4df4adaaae0e2ba7d43.exe
    "C:\Users\Admin\AppData\Local\Temp\57a7a1843876f34f2b03259d36107b61519d9d115637d4df4adaaae0e2ba7d43.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkNR0761Xz.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkNR0761Xz.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw71uQ01BX11.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw71uQ01BX11.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1932
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkpL86Ur79zK.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkpL86Ur79zK.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2832
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 1396
          4⤵
          • Program crash
          PID:2096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upVh46Yi96QZ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upVh46Yi96QZ.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2960
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2832 -ip 2832
    1⤵
      PID:3652

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upVh46Yi96QZ.exe

      Filesize

      175KB

      MD5

      585cec91521ce98dd2ed5bd0666136b4

      SHA1

      a13055a9f40435f77062f1accf79b7ee61639c88

      SHA256

      b0e5fc35fe082d1373afc0e8cf510482e09a124be4611e8b91a2cb2db58b03ef

      SHA512

      30f5b4c7d37912f6a7027675378ab97105d9b373adc3293b070e8f2a9efa0914af2804be1c79253aa10b1578466f141f51c4244e907bbe9446c265f9e8e2a871

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upVh46Yi96QZ.exe

      Filesize

      175KB

      MD5

      585cec91521ce98dd2ed5bd0666136b4

      SHA1

      a13055a9f40435f77062f1accf79b7ee61639c88

      SHA256

      b0e5fc35fe082d1373afc0e8cf510482e09a124be4611e8b91a2cb2db58b03ef

      SHA512

      30f5b4c7d37912f6a7027675378ab97105d9b373adc3293b070e8f2a9efa0914af2804be1c79253aa10b1578466f141f51c4244e907bbe9446c265f9e8e2a871

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkNR0761Xz.exe

      Filesize

      411KB

      MD5

      febdb9e77c153a36fdcf3dfe77141dfd

      SHA1

      737afad2d0f70fbffa163c6558a87417e2300d1c

      SHA256

      e31a82c1c40c40dd86cd27dccbc503cf8ca08d45c2de8572a351a563cf4fc0f3

      SHA512

      03b4a76d7150cd944df94c0aaa2133b90a9ec6b62dfee77e21f15b99aa62eae00180f6021bdf646b9097119c0df6eab9a4325c41b402f3a5b654a78836ce44f8

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkNR0761Xz.exe

      Filesize

      411KB

      MD5

      febdb9e77c153a36fdcf3dfe77141dfd

      SHA1

      737afad2d0f70fbffa163c6558a87417e2300d1c

      SHA256

      e31a82c1c40c40dd86cd27dccbc503cf8ca08d45c2de8572a351a563cf4fc0f3

      SHA512

      03b4a76d7150cd944df94c0aaa2133b90a9ec6b62dfee77e21f15b99aa62eae00180f6021bdf646b9097119c0df6eab9a4325c41b402f3a5b654a78836ce44f8

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw71uQ01BX11.exe

      Filesize

      17KB

      MD5

      f561b4450c5681a56c3f2683075e2810

      SHA1

      5f3936126827eb89f574db4c36015fff69645d9b

      SHA256

      f04acf6cc1fb1046dc90899352e7bb36f6bc13af9e4dc175abec23de46625a5c

      SHA512

      0398556c49ba7843f3ec8178528c6776b5dc21e5eb102f591af704dd662857135ae1f05b7e04fc0c32cc19deba444bca60319ca6ff626d75a477a2fac524531c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw71uQ01BX11.exe

      Filesize

      17KB

      MD5

      f561b4450c5681a56c3f2683075e2810

      SHA1

      5f3936126827eb89f574db4c36015fff69645d9b

      SHA256

      f04acf6cc1fb1046dc90899352e7bb36f6bc13af9e4dc175abec23de46625a5c

      SHA512

      0398556c49ba7843f3ec8178528c6776b5dc21e5eb102f591af704dd662857135ae1f05b7e04fc0c32cc19deba444bca60319ca6ff626d75a477a2fac524531c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkpL86Ur79zK.exe

      Filesize

      410KB

      MD5

      dd957a86774a219d7a7c1dc3b2f39fdc

      SHA1

      44158d89d13015254526a17a20a65a3ddd05e85c

      SHA256

      e154068bcbd7ab9a1ad782314383ff0f4bdef76b23ed99aded1f7260c61230cb

      SHA512

      a6e615f934c7775ff4e227642506e0effb2a1f015c8edee62ab518c8c3d3bbfc591ac01b541dc6a0ef8efb581bb3c5c722ed9a6d437839f28f88829a1b8233fc

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkpL86Ur79zK.exe

      Filesize

      410KB

      MD5

      dd957a86774a219d7a7c1dc3b2f39fdc

      SHA1

      44158d89d13015254526a17a20a65a3ddd05e85c

      SHA256

      e154068bcbd7ab9a1ad782314383ff0f4bdef76b23ed99aded1f7260c61230cb

      SHA512

      a6e615f934c7775ff4e227642506e0effb2a1f015c8edee62ab518c8c3d3bbfc591ac01b541dc6a0ef8efb581bb3c5c722ed9a6d437839f28f88829a1b8233fc

    • memory/1932-147-0x0000000000670000-0x000000000067A000-memory.dmp

      Filesize

      40KB

    • memory/2832-153-0x0000000002CD0000-0x0000000002D1B000-memory.dmp

      Filesize

      300KB

    • memory/2832-154-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-155-0x00000000071A0000-0x0000000007744000-memory.dmp

      Filesize

      5.6MB

    • memory/2832-156-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-159-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-157-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-161-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-163-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-165-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-169-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-171-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-167-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-173-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-175-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-177-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-179-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-183-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-181-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-186-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-185-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-187-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-189-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-193-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-191-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-195-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-197-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-199-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-201-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-203-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-205-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-207-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-209-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-211-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-213-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-215-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-217-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-219-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-221-0x0000000007750000-0x000000000778E000-memory.dmp

      Filesize

      248KB

    • memory/2832-1064-0x0000000007920000-0x0000000007F38000-memory.dmp

      Filesize

      6.1MB

    • memory/2832-1065-0x0000000007FC0000-0x00000000080CA000-memory.dmp

      Filesize

      1.0MB

    • memory/2832-1066-0x0000000008100000-0x0000000008112000-memory.dmp

      Filesize

      72KB

    • memory/2832-1067-0x0000000008120000-0x000000000815C000-memory.dmp

      Filesize

      240KB

    • memory/2832-1068-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-1070-0x0000000008420000-0x00000000084B2000-memory.dmp

      Filesize

      584KB

    • memory/2832-1071-0x00000000084C0000-0x0000000008526000-memory.dmp

      Filesize

      408KB

    • memory/2832-1072-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-1073-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-1074-0x0000000008BD0000-0x0000000008D92000-memory.dmp

      Filesize

      1.8MB

    • memory/2832-1075-0x0000000008DB0000-0x00000000092DC000-memory.dmp

      Filesize

      5.2MB

    • memory/2832-1076-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/2832-1077-0x00000000097C0000-0x0000000009836000-memory.dmp

      Filesize

      472KB

    • memory/2832-1078-0x0000000009840000-0x0000000009890000-memory.dmp

      Filesize

      320KB

    • memory/2960-1084-0x0000000000440000-0x0000000000472000-memory.dmp

      Filesize

      200KB

    • memory/2960-1085-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB

    • memory/2960-1086-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

      Filesize

      64KB