Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2023, 04:13
Static task
static1
Behavioral task
behavioral1
Sample
34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe
Resource
win10v2004-20230220-en
General
-
Target
34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe
-
Size
530KB
-
MD5
9855e25a7a83ee6333522c0853b02f62
-
SHA1
c40499497e33c515a5f9316bad6fd385f58788de
-
SHA256
34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938
-
SHA512
9b58d2f9f8c2232ad6d1a86777288dfea6a22106eb183fff610732db9a9d22556eb0352499a5f25321818efaab49cf3051a5e7378f18a83f8ee4cc8cbd613381
-
SSDEEP
12288:NMryy90MZu4VWRFOAzkHWQZYeQ3ZafNhcabqF9:Ty3BVgFOCWYTsHqb
Malware Config
Extracted
redline
rosto
hueref.eu:4162
-
auth_value
07d81eba8cad42bbd0ae60042d48eac6
Extracted
redline
foksa
hueref.eu:4162
-
auth_value
6a9b2601a21672b285de3ed41b5402e4
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sw77aM58DL12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sw77aM58DL12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sw77aM58DL12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sw77aM58DL12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sw77aM58DL12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sw77aM58DL12.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
resource yara_rule behavioral1/memory/1032-157-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-158-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-160-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-162-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-164-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-166-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-168-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-170-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-172-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-174-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-176-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-178-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-180-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-182-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-184-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-186-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-188-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-190-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-192-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-194-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-196-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-198-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-200-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-202-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-204-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-206-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-208-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-210-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-212-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-214-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-216-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-218-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline behavioral1/memory/1032-220-0x00000000025F0000-0x000000000262E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 532 vkJh1806PJ.exe 4504 sw77aM58DL12.exe 1032 tkiu49Om18wP.exe 1616 upee92zD16Lm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sw77aM58DL12.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vkJh1806PJ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vkJh1806PJ.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1140 1032 WerFault.exe 93 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4504 sw77aM58DL12.exe 4504 sw77aM58DL12.exe 1032 tkiu49Om18wP.exe 1032 tkiu49Om18wP.exe 1616 upee92zD16Lm.exe 1616 upee92zD16Lm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4504 sw77aM58DL12.exe Token: SeDebugPrivilege 1032 tkiu49Om18wP.exe Token: SeDebugPrivilege 1616 upee92zD16Lm.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3208 wrote to memory of 532 3208 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe 86 PID 3208 wrote to memory of 532 3208 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe 86 PID 3208 wrote to memory of 532 3208 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe 86 PID 532 wrote to memory of 4504 532 vkJh1806PJ.exe 87 PID 532 wrote to memory of 4504 532 vkJh1806PJ.exe 87 PID 532 wrote to memory of 1032 532 vkJh1806PJ.exe 93 PID 532 wrote to memory of 1032 532 vkJh1806PJ.exe 93 PID 532 wrote to memory of 1032 532 vkJh1806PJ.exe 93 PID 3208 wrote to memory of 1616 3208 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe 97 PID 3208 wrote to memory of 1616 3208 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe 97 PID 3208 wrote to memory of 1616 3208 34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe"C:\Users\Admin\AppData\Local\Temp\34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJh1806PJ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJh1806PJ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw77aM58DL12.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw77aM58DL12.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkiu49Om18wP.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkiu49Om18wP.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 20124⤵
- Program crash
PID:1140
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upee92zD16Lm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upee92zD16Lm.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1032 -ip 10321⤵PID:3848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
386KB
MD524a85e742d5972eb6402703fa68a53ff
SHA145ef90d0f65f84586ee359b36d67f9678aa3a951
SHA2562b3809f891fcfea7eb23787ddbd5b21db1670e8f70a2e4194619c13e38db3955
SHA51206055a1b073bdaa9830cf15a32bef2c13e6c3caca0d5d44f7271f11c6b12caba0fd1f85cefa14a1a2b95631a09226bb347e2822aec0ff183d6a867b7ba321791
-
Filesize
386KB
MD524a85e742d5972eb6402703fa68a53ff
SHA145ef90d0f65f84586ee359b36d67f9678aa3a951
SHA2562b3809f891fcfea7eb23787ddbd5b21db1670e8f70a2e4194619c13e38db3955
SHA51206055a1b073bdaa9830cf15a32bef2c13e6c3caca0d5d44f7271f11c6b12caba0fd1f85cefa14a1a2b95631a09226bb347e2822aec0ff183d6a867b7ba321791
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
289KB
MD51c795044102f7759152f7661b15c22bf
SHA166e3fee6ce5c4fd8974bb493b8ea7f63f0de4224
SHA2568f76de3f10a19e704eaaa544d8b0aea616b3b55e5e9d4f91afed3db0c60714a4
SHA5128c6313c1b71200f905a41b131ebb5a54f4057dd14fe062565674b4d86ebdb8ca2faf8655c970bb3ba279d34ea761c0d71d81c94f3fc9cec7dd2c49737b7653a1
-
Filesize
289KB
MD51c795044102f7759152f7661b15c22bf
SHA166e3fee6ce5c4fd8974bb493b8ea7f63f0de4224
SHA2568f76de3f10a19e704eaaa544d8b0aea616b3b55e5e9d4f91afed3db0c60714a4
SHA5128c6313c1b71200f905a41b131ebb5a54f4057dd14fe062565674b4d86ebdb8ca2faf8655c970bb3ba279d34ea761c0d71d81c94f3fc9cec7dd2c49737b7653a1