Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    55s
  • max time network
    67s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/03/2023, 05:44

General

  • Target

    39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe

  • Size

    531KB

  • MD5

    70ae8c834742ccc9b4a4a08f6d21701d

  • SHA1

    9e28263d58b50a36a3ad5c55479c4e54096f8899

  • SHA256

    39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1

  • SHA512

    5442d3d4634b61042c4d4f51ab87217f3fb8d01f430854ee928c8c0dd14d20b371440569ccc4c2d9fed4feeb5178acf4e864f665b55d68be627e099c495bcca5

  • SSDEEP

    12288:8Mrcy90wOYUSqqc5+BiimklnwfocopXw4CyIa4dGxrbku0h7/g:gygFtInM9Ib4dUkuws

Malware Config

Extracted

Family

redline

Botnet

rosto

C2

hueref.eu:4162

Attributes
  • auth_value

    07d81eba8cad42bbd0ae60042d48eac6

Extracted

Family

redline

Botnet

foksa

C2

hueref.eu:4162

Attributes
  • auth_value

    6a9b2601a21672b285de3ed41b5402e4

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 38 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe
    "C:\Users\Admin\AppData\Local\Temp\39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2612
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkhk0599aV.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkhk0599aV.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw63af35yU09.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw63af35yU09.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4128
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkIx57eq47GK.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkIx57eq47GK.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4492
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upCX17Nq42dV.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upCX17Nq42dV.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upCX17Nq42dV.exe

    Filesize

    175KB

    MD5

    75ced8ad0d8cd237ebc9cb7b00852651

    SHA1

    adab63df3e0a40fd9f170ab57da66f01f226141c

    SHA256

    a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

    SHA512

    f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upCX17Nq42dV.exe

    Filesize

    175KB

    MD5

    75ced8ad0d8cd237ebc9cb7b00852651

    SHA1

    adab63df3e0a40fd9f170ab57da66f01f226141c

    SHA256

    a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819

    SHA512

    f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkhk0599aV.exe

    Filesize

    386KB

    MD5

    5f246f7bb044ed2c4f7821238ae80a2f

    SHA1

    f78d01490c93576ff8e819cdb13f45cd53ea8306

    SHA256

    de10eb47588d8d32cbdbc1b32a583acea2b45e09acc740f544a34a1ad944ff06

    SHA512

    f7bcc16228c11db744e904ac6da698d5a9358d8877a38af4808806fbe0826eb635d19e8e1fae02c26ab7e44b6b91dc54a644c8739664c9781284aa621b39ab40

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkhk0599aV.exe

    Filesize

    386KB

    MD5

    5f246f7bb044ed2c4f7821238ae80a2f

    SHA1

    f78d01490c93576ff8e819cdb13f45cd53ea8306

    SHA256

    de10eb47588d8d32cbdbc1b32a583acea2b45e09acc740f544a34a1ad944ff06

    SHA512

    f7bcc16228c11db744e904ac6da698d5a9358d8877a38af4808806fbe0826eb635d19e8e1fae02c26ab7e44b6b91dc54a644c8739664c9781284aa621b39ab40

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw63af35yU09.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw63af35yU09.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkIx57eq47GK.exe

    Filesize

    290KB

    MD5

    8fee42f989bab807a7e66858ba5fe89d

    SHA1

    2f0c74aba0b54d351ac033248a718fa08edbfd91

    SHA256

    0b8c7c56907917d4b837cb95e0f7f47223d4457ddddd5986922cd7e3d61d70e5

    SHA512

    d4e1289b7bd0255a74eb8b85b552326ef288d45a9c69188a70215ecba62c984ecdb2ebb8ded103a699d109bf6d82ade212ed7c3dda8e04e780a79593cc3f6926

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkIx57eq47GK.exe

    Filesize

    290KB

    MD5

    8fee42f989bab807a7e66858ba5fe89d

    SHA1

    2f0c74aba0b54d351ac033248a718fa08edbfd91

    SHA256

    0b8c7c56907917d4b837cb95e0f7f47223d4457ddddd5986922cd7e3d61d70e5

    SHA512

    d4e1289b7bd0255a74eb8b85b552326ef288d45a9c69188a70215ecba62c984ecdb2ebb8ded103a699d109bf6d82ade212ed7c3dda8e04e780a79593cc3f6926

  • memory/4128-134-0x0000000000CE0000-0x0000000000CEA000-memory.dmp

    Filesize

    40KB

  • memory/4492-140-0x0000000000660000-0x00000000006AB000-memory.dmp

    Filesize

    300KB

  • memory/4492-141-0x0000000004AF0000-0x0000000004B36000-memory.dmp

    Filesize

    280KB

  • memory/4492-142-0x0000000004B40000-0x000000000503E000-memory.dmp

    Filesize

    5.0MB

  • memory/4492-143-0x0000000005080000-0x00000000050C4000-memory.dmp

    Filesize

    272KB

  • memory/4492-144-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-145-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-147-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-149-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-151-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-153-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-155-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-157-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-160-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-162-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-159-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-164-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-166-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-163-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-168-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-170-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-172-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-174-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-176-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-178-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-180-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-182-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-184-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-186-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-188-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-190-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-192-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-194-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-196-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-198-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-202-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-204-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-200-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-206-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-208-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-210-0x0000000005080000-0x00000000050BE000-memory.dmp

    Filesize

    248KB

  • memory/4492-1053-0x0000000005810000-0x0000000005E16000-memory.dmp

    Filesize

    6.0MB

  • memory/4492-1054-0x0000000005260000-0x000000000536A000-memory.dmp

    Filesize

    1.0MB

  • memory/4492-1055-0x00000000053A0000-0x00000000053B2000-memory.dmp

    Filesize

    72KB

  • memory/4492-1056-0x00000000053C0000-0x00000000053FE000-memory.dmp

    Filesize

    248KB

  • memory/4492-1057-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-1058-0x0000000005510000-0x000000000555B000-memory.dmp

    Filesize

    300KB

  • memory/4492-1060-0x00000000056B0000-0x0000000005742000-memory.dmp

    Filesize

    584KB

  • memory/4492-1061-0x0000000005750000-0x00000000057B6000-memory.dmp

    Filesize

    408KB

  • memory/4492-1062-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-1063-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-1064-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4492-1065-0x0000000006470000-0x0000000006632000-memory.dmp

    Filesize

    1.8MB

  • memory/4492-1066-0x0000000006640000-0x0000000006B6C000-memory.dmp

    Filesize

    5.2MB

  • memory/4492-1067-0x0000000006CA0000-0x0000000006D16000-memory.dmp

    Filesize

    472KB

  • memory/4492-1068-0x0000000006D20000-0x0000000006D70000-memory.dmp

    Filesize

    320KB

  • memory/4492-1069-0x0000000004B30000-0x0000000004B40000-memory.dmp

    Filesize

    64KB

  • memory/4600-1075-0x0000000000130000-0x0000000000162000-memory.dmp

    Filesize

    200KB

  • memory/4600-1076-0x0000000004B70000-0x0000000004BBB000-memory.dmp

    Filesize

    300KB

  • memory/4600-1077-0x0000000004D20000-0x0000000004D30000-memory.dmp

    Filesize

    64KB

  • memory/4600-1078-0x0000000004D20000-0x0000000004D30000-memory.dmp

    Filesize

    64KB