Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
06/03/2023, 00:20
General
-
Target
d34d41d677e6a61ef2ed228ec27e36fc2850bbc5b6c5836846bcfa8fc418ac42.exe
-
Size
525KB
-
MD5
6d585591bfb4c2efbf0fcdb307d45aa2
-
SHA1
6cc0159a727327cd65b63e8d5946911bd9e537f6
-
SHA256
d34d41d677e6a61ef2ed228ec27e36fc2850bbc5b6c5836846bcfa8fc418ac42
-
SHA512
f49dab4ec90e3b0c7f52c18ab5bff99754f00f78c544adf00d316cda2dc0e27dd5823bd7277c576eee8744d41afbed3ccab04049106885789384fc018305505e
-
SSDEEP
6144:Kny+bnr+Sp0yN90QEDMxDh8zn/N5FL6toGisx86IjVIc3kziRNXdCw0RhSQX8Psd:hMriy90eI/Pt6ixo860OcpRCBje8NeS
Malware Config
Extracted
redline
fud
193.233.20.27:4123
-
auth_value
cddc991efd6918ad5321d80dac884b40
Extracted
redline
fabio
193.233.20.27:4123
-
auth_value
56b82736c3f56b13be8e64c87d2cf9e5
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d34d41d677e6a61ef2ed228ec27e36fc2850bbc5b6c5836846bcfa8fc418ac42.exe"C:\Users\Admin\AppData\Local\Temp\d34d41d677e6a61ef2ed228ec27e36fc2850bbc5b6c5836846bcfa8fc418ac42.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPL1933Ev.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhPL1933Ev.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf90iD19AR02.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf90iD19AR02.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf23Hx34dW53.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf23Hx34dW53.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2492 -s 13524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhmG48PX70YX.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhmG48PX70YX.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2492 -ip 24921⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD57a284b306de088b4b22cbab6519f33b6
SHA18b9ea963abb1180e96d1de97f6d7169501e7b765
SHA25635f54babfcd0c808ab8ca8144835ddacf27c8750fddec034bb9a014fae315ba1
SHA512749573b8f04c99fe254bf360da7025aa0f6b402730520eec7d2242257b640033de0d34ddbbbb423cc7adc01143def15c68563a13f6a5d6c04f056809919b85c4
-
Filesize
176KB
MD57a284b306de088b4b22cbab6519f33b6
SHA18b9ea963abb1180e96d1de97f6d7169501e7b765
SHA25635f54babfcd0c808ab8ca8144835ddacf27c8750fddec034bb9a014fae315ba1
SHA512749573b8f04c99fe254bf360da7025aa0f6b402730520eec7d2242257b640033de0d34ddbbbb423cc7adc01143def15c68563a13f6a5d6c04f056809919b85c4
-
Filesize
380KB
MD550c17ff8feea91fc8f1408a453576760
SHA1737721b140acc3eb7a80f486ce5781022201bd20
SHA256e4e05ef1bfc54988fef70cb74dd03cced3f47cda63ca5ae73ddce3d97ce7c883
SHA5129fd888a6957f526db4a3c7389ac4c4b208f808a56dabdc7794c397f3b1d4f3fde17acd349f8826ac5a76e511252764fe298b808a6d078c14b9e22990d6809f83
-
Filesize
380KB
MD550c17ff8feea91fc8f1408a453576760
SHA1737721b140acc3eb7a80f486ce5781022201bd20
SHA256e4e05ef1bfc54988fef70cb74dd03cced3f47cda63ca5ae73ddce3d97ce7c883
SHA5129fd888a6957f526db4a3c7389ac4c4b208f808a56dabdc7794c397f3b1d4f3fde17acd349f8826ac5a76e511252764fe298b808a6d078c14b9e22990d6809f83
-
Filesize
12KB
MD55b0518f5829fc06e615951327babfc42
SHA10c5621ed1ea60443cc9cdfa819da82c8ecfe2e3a
SHA25626bb7a8f8316864c65733d6c209314247b68f4cf20505c570d6d16aa294cb17d
SHA5121003d8d101f822cb3c8c8c2e34f2eea6447ce3b6d53519c877cb18f714645731f505682e7dbffce7c4c8cb92fcf41a9999bd4a96fdf8927c97623db46f5bd67a
-
Filesize
12KB
MD55b0518f5829fc06e615951327babfc42
SHA10c5621ed1ea60443cc9cdfa819da82c8ecfe2e3a
SHA25626bb7a8f8316864c65733d6c209314247b68f4cf20505c570d6d16aa294cb17d
SHA5121003d8d101f822cb3c8c8c2e34f2eea6447ce3b6d53519c877cb18f714645731f505682e7dbffce7c4c8cb92fcf41a9999bd4a96fdf8927c97623db46f5bd67a
-
Filesize
291KB
MD5249978248eadf5f91425671a026f54a0
SHA180596f205182dcbeb05b93e5cdb77a067c723cf1
SHA2560acc998717f3d96cb94c3160c2f07c54c5244d4d29df38db9ca0b5a71f219682
SHA512aadc502c62ada1e529b0a11a335694cba325cb4d3ae1b85fac8d110238314b4f2bb6f4cae21bb15183a0252835bbc02a0d094c5911d0d7f1c74c4a1ba1167a14
-
Filesize
291KB
MD5249978248eadf5f91425671a026f54a0
SHA180596f205182dcbeb05b93e5cdb77a067c723cf1
SHA2560acc998717f3d96cb94c3160c2f07c54c5244d4d29df38db9ca0b5a71f219682
SHA512aadc502c62ada1e529b0a11a335694cba325cb4d3ae1b85fac8d110238314b4f2bb6f4cae21bb15183a0252835bbc02a0d094c5911d0d7f1c74c4a1ba1167a14
-
Filesize
40KB
-
Filesize
300KB
-
Filesize
5.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
200KB
-
Filesize
64KB