Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
04/03/2023, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe
Resource
win10-20230220-en
General
-
Target
c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe
-
Size
531KB
-
MD5
84811dc05ff749842a0f092cae9f7f06
-
SHA1
6e2fa5e152b30d0b7928284f77e3d39c376d1432
-
SHA256
c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725
-
SHA512
bb6f5dc6037cf777a2626aee3c2e6b7ce88f941aad5b4ae90eef0ce6f03c2a1def8ea83188772dbf773fd090c6aa5ee0dffc17fc558894debbc68056dac7a10f
-
SSDEEP
12288:RMrcy90TR8qi8PU37K3Km39pmBf0A8EBFgF:NycrmK629QlgF
Malware Config
Extracted
redline
rosto
hueref.eu:4162
-
auth_value
07d81eba8cad42bbd0ae60042d48eac6
Extracted
redline
foksa
hueref.eu:4162
-
auth_value
6a9b2601a21672b285de3ed41b5402e4
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sw31ff01As70.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sw31ff01As70.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sw31ff01As70.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sw31ff01As70.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sw31ff01As70.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/3916-141-0x0000000002330000-0x0000000002376000-memory.dmp family_redline behavioral1/memory/3916-143-0x0000000004B20000-0x0000000004B64000-memory.dmp family_redline behavioral1/memory/3916-146-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-148-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-150-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-152-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-154-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-156-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-158-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-160-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-162-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-164-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-166-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-168-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-170-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-172-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-174-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-176-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-178-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-180-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-182-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-184-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-186-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-188-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-190-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-192-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-194-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-196-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-198-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-200-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-202-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-204-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-206-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-208-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline behavioral1/memory/3916-210-0x0000000004B20000-0x0000000004B5E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 4260 vkQV4939NB.exe 3928 sw31ff01As70.exe 3916 tkme88vy87zy.exe 5028 upRA21LJ79Ak.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sw31ff01As70.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce vkQV4939NB.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vkQV4939NB.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3928 sw31ff01As70.exe 3928 sw31ff01As70.exe 3916 tkme88vy87zy.exe 3916 tkme88vy87zy.exe 5028 upRA21LJ79Ak.exe 5028 upRA21LJ79Ak.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3928 sw31ff01As70.exe Token: SeDebugPrivilege 3916 tkme88vy87zy.exe Token: SeDebugPrivilege 5028 upRA21LJ79Ak.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4192 wrote to memory of 4260 4192 c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe 66 PID 4192 wrote to memory of 4260 4192 c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe 66 PID 4192 wrote to memory of 4260 4192 c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe 66 PID 4260 wrote to memory of 3928 4260 vkQV4939NB.exe 67 PID 4260 wrote to memory of 3928 4260 vkQV4939NB.exe 67 PID 4260 wrote to memory of 3916 4260 vkQV4939NB.exe 68 PID 4260 wrote to memory of 3916 4260 vkQV4939NB.exe 68 PID 4260 wrote to memory of 3916 4260 vkQV4939NB.exe 68 PID 4192 wrote to memory of 5028 4192 c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe 70 PID 4192 wrote to memory of 5028 4192 c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe 70 PID 4192 wrote to memory of 5028 4192 c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe"C:\Users\Admin\AppData\Local\Temp\c3fe9417ac7dfdfa1e279f8073d0cb894a4d050fb9c24709c8f84eb6f325f725.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkQV4939NB.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vkQV4939NB.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw31ff01As70.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw31ff01As70.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkme88vy87zy.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tkme88vy87zy.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upRA21LJ79Ak.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\upRA21LJ79Ak.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
175KB
MD575ced8ad0d8cd237ebc9cb7b00852651
SHA1adab63df3e0a40fd9f170ab57da66f01f226141c
SHA256a35a264162c124ffd066dd867ed96359131d37b243cb0445c1c9eba6a58de819
SHA512f565a49b14671683a1e48cece82a437a79bf8bdb456a3c6f35fac020e5fef3cd666399208633b7d2da9407f7b334a311a416b0a969c8b62ff28e15e7d4a0c431
-
Filesize
386KB
MD54bdb53fc0c1cbfd76696685c538f3ada
SHA1327e529c8bcf787ece16e85f37fb1b7bd0736d6c
SHA256315bdc4091aaa0fbdc1e1049241cdbac89a9432d0755198bd4ec0cc5a23960a1
SHA51205c5ce2a9273a290147740bd7d0b274826b4a2f2ca49b3b5127d1aceda85bb22eb9bd6cb101b0b543aa99db8e95742c7a91f3c6660e4e71d55e6f6e2c62aabcb
-
Filesize
386KB
MD54bdb53fc0c1cbfd76696685c538f3ada
SHA1327e529c8bcf787ece16e85f37fb1b7bd0736d6c
SHA256315bdc4091aaa0fbdc1e1049241cdbac89a9432d0755198bd4ec0cc5a23960a1
SHA51205c5ce2a9273a290147740bd7d0b274826b4a2f2ca49b3b5127d1aceda85bb22eb9bd6cb101b0b543aa99db8e95742c7a91f3c6660e4e71d55e6f6e2c62aabcb
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
290KB
MD55219e8f0103dcdc1edfc06a291fa3dc5
SHA1176526bf4ebef1bfcf7cf535ae8707739e8b94ef
SHA25679e9c0528a3deef77dc8e379e8d4d889ecabd5cf04e1d6756f92ca55c13f4a7d
SHA512445da5e0a94d36dd96da459d028d706ed5067f4b95f30708d44daeeea933f01f42999f51cd1a889a73173e43924b1957e8259834dd5327c3b0d7baf4b1edbbf6
-
Filesize
290KB
MD55219e8f0103dcdc1edfc06a291fa3dc5
SHA1176526bf4ebef1bfcf7cf535ae8707739e8b94ef
SHA25679e9c0528a3deef77dc8e379e8d4d889ecabd5cf04e1d6756f92ca55c13f4a7d
SHA512445da5e0a94d36dd96da459d028d706ed5067f4b95f30708d44daeeea933f01f42999f51cd1a889a73173e43924b1957e8259834dd5327c3b0d7baf4b1edbbf6