Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
04/03/2023, 02:51 UTC
General
-
Target
224cd11052d9b94eeaa9ee3ffa073a1452bdcb545eeb7a9702120df05240b347.exe
-
Size
530KB
-
MD5
a0ca8917c44dbabbad35ebfdf6247a60
-
SHA1
2dbbb488d0fb0da3cb17e9dead3eead6450a3fb7
-
SHA256
224cd11052d9b94eeaa9ee3ffa073a1452bdcb545eeb7a9702120df05240b347
-
SHA512
dca5657e074f90151a5eb55e95c0c1d3ea206bb85e97bfb7d2279559c9e3b4cf4f32d7a41adae63b5764ba1208396f6ce22fa1b06bb7778ce15ed313fdd80313
-
SSDEEP
12288:XMrcy90WFT+p6tkk77cX6HWQZzlQ3Zm/7hgqTPd:jyKFk7Zz2Q11
Malware Config
Extracted
redline
rosto
hueref.eu:4162
-
auth_value
07d81eba8cad42bbd0ae60042d48eac6
Extracted
redline
foksa
hueref.eu:4162
-
auth_value
6a9b2601a21672b285de3ed41b5402e4
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\224cd11052d9b94eeaa9ee3ffa073a1452bdcb545eeb7a9702120df05240b347.exe"C:\Users\Admin\AppData\Local\Temp\224cd11052d9b94eeaa9ee3ffa073a1452bdcb545eeb7a9702120df05240b347.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkEo8719Mh.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkEo8719Mh.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw44zS54bl52.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw44zS54bl52.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkQj45Qv62Yx.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkQj45Qv62Yx.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upZi56OY06bx.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upZi56OY06bx.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
-
DNShueref.euRemote address:8.8.8.8:53Requesthueref.euIN AResponsehueref.euIN A193.56.146.11 -
DNS11.146.56.193.in-addr.arpaRemote address:8.8.8.8:53Request11.146.56.193.in-addr.arpaIN PTRResponse
-
DNS64.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request64.13.109.52.in-addr.arpaIN PTRResponse
-
193.56.146.11:4162hueref.eu -
193.56.146.11:4162hueref.eu
-
8.8.8.8:53hueref.eudns
DNS Request
hueref.eu
DNS Response
193.56.146.11
-
8.8.8.8:5311.146.56.193.in-addr.arpadns
DNS Request
11.146.56.193.in-addr.arpa
-
8.8.8.8:5364.13.109.52.in-addr.arpadns
DNS Request
64.13.109.52.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
386KB
MD5a25c331b24ed80c7e86a48735b6380eb
SHA1f28bb2f2f71ac0e9cf9a47d4ffb33ef7d455010e
SHA256e8efb9ff8dc8a649b8f9bd33b8dd1c9dcfa5370f1478201ed69ab991834aa8d5
SHA5129911d2ba09ed176c23c82a4e3fba9d2f01a078e4cd8979609dd7a45e21683caf3a58749cc89ce7a2ddf3f5c8936f6bb2e4dbad1f34b29451b3fb25b33c5af709
-
Filesize
386KB
MD5a25c331b24ed80c7e86a48735b6380eb
SHA1f28bb2f2f71ac0e9cf9a47d4ffb33ef7d455010e
SHA256e8efb9ff8dc8a649b8f9bd33b8dd1c9dcfa5370f1478201ed69ab991834aa8d5
SHA5129911d2ba09ed176c23c82a4e3fba9d2f01a078e4cd8979609dd7a45e21683caf3a58749cc89ce7a2ddf3f5c8936f6bb2e4dbad1f34b29451b3fb25b33c5af709
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
289KB
MD51c795044102f7759152f7661b15c22bf
SHA166e3fee6ce5c4fd8974bb493b8ea7f63f0de4224
SHA2568f76de3f10a19e704eaaa544d8b0aea616b3b55e5e9d4f91afed3db0c60714a4
SHA5128c6313c1b71200f905a41b131ebb5a54f4057dd14fe062565674b4d86ebdb8ca2faf8655c970bb3ba279d34ea761c0d71d81c94f3fc9cec7dd2c49737b7653a1
-
Filesize
289KB
MD51c795044102f7759152f7661b15c22bf
SHA166e3fee6ce5c4fd8974bb493b8ea7f63f0de4224
SHA2568f76de3f10a19e704eaaa544d8b0aea616b3b55e5e9d4f91afed3db0c60714a4
SHA5128c6313c1b71200f905a41b131ebb5a54f4057dd14fe062565674b4d86ebdb8ca2faf8655c970bb3ba279d34ea761c0d71d81c94f3fc9cec7dd2c49737b7653a1
-
Filesize
40KB
-
Filesize
280KB
-
Filesize
5.0MB
-
Filesize
272KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.0MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
300KB
-
Filesize
64KB