Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
67s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
04/03/2023, 05:44
Static task
static1
Behavioral task
behavioral1
Sample
39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe
Resource
win10-20230220-en
General
-
Target
39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe
-
Size
531KB
-
MD5
70ae8c834742ccc9b4a4a08f6d21701d
-
SHA1
9e28263d58b50a36a3ad5c55479c4e54096f8899
-
SHA256
39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1
-
SHA512
5442d3d4634b61042c4d4f51ab87217f3fb8d01f430854ee928c8c0dd14d20b371440569ccc4c2d9fed4feeb5178acf4e864f665b55d68be627e099c495bcca5
-
SSDEEP
12288:8Mrcy90wOYUSqqc5+BiimklnwfocopXw4CyIa4dGxrbku0h7/g:gygFtInM9Ib4dUkuws
Malware Config
Extracted
redline
rosto
hueref.eu:4162
-
auth_value
07d81eba8cad42bbd0ae60042d48eac6
Extracted
redline
foksa
hueref.eu:4162
-
auth_value
6a9b2601a21672b285de3ed41b5402e4
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sw63af35yU09.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sw63af35yU09.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sw63af35yU09.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sw63af35yU09.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sw63af35yU09.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 38 IoCs
resource yara_rule behavioral1/memory/4492-141-0x0000000004AF0000-0x0000000004B36000-memory.dmp family_redline behavioral1/memory/4492-143-0x0000000005080000-0x00000000050C4000-memory.dmp family_redline behavioral1/memory/4492-144-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-145-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-147-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-149-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-151-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-153-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-155-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-157-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-162-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline behavioral1/memory/4492-159-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-164-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline behavioral1/memory/4492-166-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-163-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-168-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-170-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-172-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-174-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-176-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-178-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-180-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-182-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-184-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-186-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-188-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-190-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-192-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-194-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-196-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-198-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-202-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-204-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-200-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-206-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-208-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-210-0x0000000005080000-0x00000000050BE000-memory.dmp family_redline behavioral1/memory/4492-1062-0x0000000004B30000-0x0000000004B40000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 2584 vkhk0599aV.exe 4128 sw63af35yU09.exe 4492 tkIx57eq47GK.exe 4600 upCX17Nq42dV.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sw63af35yU09.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vkhk0599aV.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vkhk0599aV.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4128 sw63af35yU09.exe 4128 sw63af35yU09.exe 4492 tkIx57eq47GK.exe 4492 tkIx57eq47GK.exe 4600 upCX17Nq42dV.exe 4600 upCX17Nq42dV.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4128 sw63af35yU09.exe Token: SeDebugPrivilege 4492 tkIx57eq47GK.exe Token: SeDebugPrivilege 4600 upCX17Nq42dV.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2612 wrote to memory of 2584 2612 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe 66 PID 2612 wrote to memory of 2584 2612 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe 66 PID 2612 wrote to memory of 2584 2612 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe 66 PID 2584 wrote to memory of 4128 2584 vkhk0599aV.exe 67 PID 2584 wrote to memory of 4128 2584 vkhk0599aV.exe 67 PID 2584 wrote to memory of 4492 2584 vkhk0599aV.exe 68 PID 2584 wrote to memory of 4492 2584 vkhk0599aV.exe 68 PID 2584 wrote to memory of 4492 2584 vkhk0599aV.exe 68 PID 2612 wrote to memory of 4600 2612 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe 70 PID 2612 wrote to memory of 4600 2612 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe 70 PID 2612 wrote to memory of 4600 2612 39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe"C:\Users\Admin\AppData\Local\Temp\39f65d362b0ef13efd6b41960c7c275b3ed4c2c322f452562d84d487bc12d0c1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkhk0599aV.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkhk0599aV.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw63af35yU09.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw63af35yU09.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkIx57eq47GK.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkIx57eq47GK.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upCX17Nq42dV.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upCX17Nq42dV.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4600
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
386KB
MD55f246f7bb044ed2c4f7821238ae80a2f
SHA1f78d01490c93576ff8e819cdb13f45cd53ea8306
SHA256de10eb47588d8d32cbdbc1b32a583acea2b45e09acc740f544a34a1ad944ff06
SHA512f7bcc16228c11db744e904ac6da698d5a9358d8877a38af4808806fbe0826eb635d19e8e1fae02c26ab7e44b6b91dc54a644c8739664c9781284aa621b39ab40
-
Filesize
386KB
MD55f246f7bb044ed2c4f7821238ae80a2f
SHA1f78d01490c93576ff8e819cdb13f45cd53ea8306
SHA256de10eb47588d8d32cbdbc1b32a583acea2b45e09acc740f544a34a1ad944ff06
SHA512f7bcc16228c11db744e904ac6da698d5a9358d8877a38af4808806fbe0826eb635d19e8e1fae02c26ab7e44b6b91dc54a644c8739664c9781284aa621b39ab40
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
290KB
MD58fee42f989bab807a7e66858ba5fe89d
SHA12f0c74aba0b54d351ac033248a718fa08edbfd91
SHA2560b8c7c56907917d4b837cb95e0f7f47223d4457ddddd5986922cd7e3d61d70e5
SHA512d4e1289b7bd0255a74eb8b85b552326ef288d45a9c69188a70215ecba62c984ecdb2ebb8ded103a699d109bf6d82ade212ed7c3dda8e04e780a79593cc3f6926
-
Filesize
290KB
MD58fee42f989bab807a7e66858ba5fe89d
SHA12f0c74aba0b54d351ac033248a718fa08edbfd91
SHA2560b8c7c56907917d4b837cb95e0f7f47223d4457ddddd5986922cd7e3d61d70e5
SHA512d4e1289b7bd0255a74eb8b85b552326ef288d45a9c69188a70215ecba62c984ecdb2ebb8ded103a699d109bf6d82ade212ed7c3dda8e04e780a79593cc3f6926