Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2023, 04:13

General

  • Target

    34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe

  • Size

    530KB

  • MD5

    9855e25a7a83ee6333522c0853b02f62

  • SHA1

    c40499497e33c515a5f9316bad6fd385f58788de

  • SHA256

    34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938

  • SHA512

    9b58d2f9f8c2232ad6d1a86777288dfea6a22106eb183fff610732db9a9d22556eb0352499a5f25321818efaab49cf3051a5e7378f18a83f8ee4cc8cbd613381

  • SSDEEP

    12288:NMryy90MZu4VWRFOAzkHWQZYeQ3ZafNhcabqF9:Ty3BVgFOCWYTsHqb

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Extracted

Family

redline

Botnet

foksa

C2

hueref.eu:4162

Attributes
  • auth_value

    6a9b2601a21672b285de3ed41b5402e4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe
    "C:\Users\Admin\AppData\Local\Temp\34f525c07f332a86d84469b17887d9ad759d3c4e0fae47c4984a3d87ab79d938.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJh1806PJ.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJh1806PJ.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw77aM58DL12.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw77aM58DL12.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkiu49Om18wP.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkiu49Om18wP.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1032
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1032 -s 2012
          4⤵
          • Program crash
          PID:1140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upee92zD16Lm.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upee92zD16Lm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1616
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1032 -ip 1032
    1⤵
      PID:3848

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upee92zD16Lm.exe

      Filesize

      175KB

      MD5

      75ced8ad0d8cd237ebc9cb7b00852651

      SHA1

      adab63df3e0a40fd9f170ab57da66f01f226141c

      SHA256

      a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

      SHA512

      f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upee92zD16Lm.exe

      Filesize

      175KB

      MD5

      75ced8ad0d8cd237ebc9cb7b00852651

      SHA1

      adab63df3e0a40fd9f170ab57da66f01f226141c

      SHA256

      a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

      SHA512

      f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJh1806PJ.exe

      Filesize

      386KB

      MD5

      24a85e742d5972eb6402703fa68a53ff

      SHA1

      45ef90d0f65f84586ee359b36d67f9678aa3a951

      SHA256

      2b3809f891fcfea7eb23787ddbd5b21db1670e8f70a2e4194619c13e38db3955

      SHA512

      06055a1b073bdaa9830cf15a32bef2c13e6c3caca0d5d44f7271f11c6b12caba0fd1f85cefa14a1a2b95631a09226bb347e2822aec0ff183d6a867b7ba321791

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkJh1806PJ.exe

      Filesize

      386KB

      MD5

      24a85e742d5972eb6402703fa68a53ff

      SHA1

      45ef90d0f65f84586ee359b36d67f9678aa3a951

      SHA256

      2b3809f891fcfea7eb23787ddbd5b21db1670e8f70a2e4194619c13e38db3955

      SHA512

      06055a1b073bdaa9830cf15a32bef2c13e6c3caca0d5d44f7271f11c6b12caba0fd1f85cefa14a1a2b95631a09226bb347e2822aec0ff183d6a867b7ba321791

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw77aM58DL12.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw77aM58DL12.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkiu49Om18wP.exe

      Filesize

      289KB

      MD5

      1c795044102f7759152f7661b15c22bf

      SHA1

      66e3fee6ce5c4fd8974bb493b8ea7f63f0de4224

      SHA256

      8f76de3f10a19e704eaaa544d8b0aea616b3b55e5e9d4f91afed3db0c60714a4

      SHA512

      8c6313c1b71200f905a41b131ebb5a54f4057dd14fe062565674b4d86ebdb8ca2faf8655c970bb3ba279d34ea761c0d71d81c94f3fc9cec7dd2c49737b7653a1

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkiu49Om18wP.exe

      Filesize

      289KB

      MD5

      1c795044102f7759152f7661b15c22bf

      SHA1

      66e3fee6ce5c4fd8974bb493b8ea7f63f0de4224

      SHA256

      8f76de3f10a19e704eaaa544d8b0aea616b3b55e5e9d4f91afed3db0c60714a4

      SHA512

      8c6313c1b71200f905a41b131ebb5a54f4057dd14fe062565674b4d86ebdb8ca2faf8655c970bb3ba279d34ea761c0d71d81c94f3fc9cec7dd2c49737b7653a1

    • memory/1032-153-0x0000000004EC0000-0x0000000005464000-memory.dmp

      Filesize

      5.6MB

    • memory/1032-154-0x0000000000590000-0x00000000005DB000-memory.dmp

      Filesize

      300KB

    • memory/1032-156-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

      Filesize

      64KB

    • memory/1032-155-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

      Filesize

      64KB

    • memory/1032-157-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-158-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-160-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-162-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-164-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-166-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-168-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-170-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-172-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-174-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-176-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-178-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-180-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-182-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-184-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-186-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-188-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-190-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-192-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-194-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-196-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-198-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-200-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-202-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-204-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-206-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-208-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-210-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-212-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-214-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-216-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-218-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-220-0x00000000025F0000-0x000000000262E000-memory.dmp

      Filesize

      248KB

    • memory/1032-1063-0x0000000005470000-0x0000000005A88000-memory.dmp

      Filesize

      6.1MB

    • memory/1032-1064-0x0000000004CC0000-0x0000000004DCA000-memory.dmp

      Filesize

      1.0MB

    • memory/1032-1065-0x0000000002730000-0x0000000002742000-memory.dmp

      Filesize

      72KB

    • memory/1032-1066-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

      Filesize

      64KB

    • memory/1032-1067-0x0000000004DD0000-0x0000000004E0C000-memory.dmp

      Filesize

      240KB

    • memory/1032-1069-0x0000000005C90000-0x0000000005D22000-memory.dmp

      Filesize

      584KB

    • memory/1032-1070-0x0000000005D30000-0x0000000005D96000-memory.dmp

      Filesize

      408KB

    • memory/1032-1071-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

      Filesize

      64KB

    • memory/1032-1072-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

      Filesize

      64KB

    • memory/1032-1073-0x0000000004EB0000-0x0000000004EC0000-memory.dmp

      Filesize

      64KB

    • memory/1032-1074-0x00000000076F0000-0x00000000078B2000-memory.dmp

      Filesize

      1.8MB

    • memory/1032-1075-0x00000000078C0000-0x0000000007DEC000-memory.dmp

      Filesize

      5.2MB

    • memory/1032-1076-0x0000000008010000-0x0000000008086000-memory.dmp

      Filesize

      472KB

    • memory/1032-1077-0x0000000002520000-0x0000000002570000-memory.dmp

      Filesize

      320KB

    • memory/1616-1083-0x0000000000F00000-0x0000000000F32000-memory.dmp

      Filesize

      200KB

    • memory/1616-1084-0x00000000057C0000-0x00000000057D0000-memory.dmp

      Filesize

      64KB

    • memory/1616-1085-0x00000000057C0000-0x00000000057D0000-memory.dmp

      Filesize

      64KB

    • memory/4504-147-0x0000000000090000-0x000000000009A000-memory.dmp

      Filesize

      40KB