Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    90s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/03/2023, 16:27

General

  • Target

    67a98ee3e356b6495ccd00cfe6c92697bf9e49c9fc201617534dcf69976eba83.exe

  • Size

    561KB

  • MD5

    6a9ce8dc677be066e26d06302266c3f1

  • SHA1

    82f73bdb0000ad4f9b487fbd8c2b7e116e47690e

  • SHA256

    67a98ee3e356b6495ccd00cfe6c92697bf9e49c9fc201617534dcf69976eba83

  • SHA512

    ec8710f4abf147238ebdc5c34bddb75b7a31f182320bfb97049af04b1090b32d6189ab8d67b1224ddad210287fee55b5d4ed9264f1a787aba76227f35a801ca5

  • SSDEEP

    12288:wMruy90LGMLnIcY4BCmVYlINWi/9SN3TKsu++48:OyYI8WlINWqaTKsT2

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Extracted

Family

redline

Botnet

fabio

C2

193.233.20.27:4123

Attributes
  • auth_value

    56b82736c3f56b13be8e64c87d2cf9e5

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\67a98ee3e356b6495ccd00cfe6c92697bf9e49c9fc201617534dcf69976eba83.exe
    "C:\Users\Admin\AppData\Local\Temp\67a98ee3e356b6495ccd00cfe6c92697bf9e49c9fc201617534dcf69976eba83.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsz0006Rk.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsz0006Rk.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf23Ts42lB61.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf23Ts42lB61.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2984
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf07Zy43jF80.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf07Zy43jF80.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3908
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhSC85lG38YI.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhSC85lG38YI.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4652

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhSC85lG38YI.exe

    Filesize

    176KB

    MD5

    02bced30207dde9c0bf18ecebdd39aa3

    SHA1

    b5a763844ac7ca19d642540dbe6ccc0f7e22405d

    SHA256

    ec894a1592bf07fe7b995737fc5121f9bdaa39165d068a7e8e7ff6e8a55844cb

    SHA512

    e415e6a54c94d47c1cc84eca24663c141ac906baf4c50b2ae671f308fc64055f1b1b99bc9df2499eda2f682d307bc42f33fcd5a585811567548c5981b2834fd2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\uhSC85lG38YI.exe

    Filesize

    176KB

    MD5

    02bced30207dde9c0bf18ecebdd39aa3

    SHA1

    b5a763844ac7ca19d642540dbe6ccc0f7e22405d

    SHA256

    ec894a1592bf07fe7b995737fc5121f9bdaa39165d068a7e8e7ff6e8a55844cb

    SHA512

    e415e6a54c94d47c1cc84eca24663c141ac906baf4c50b2ae671f308fc64055f1b1b99bc9df2499eda2f682d307bc42f33fcd5a585811567548c5981b2834fd2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsz0006Rk.exe

    Filesize

    417KB

    MD5

    164d2f235e8d4bcca5db3657734bc0d2

    SHA1

    dcc6f678e80436b0c707473c34c9d4fc3bf1d043

    SHA256

    27914ab152be17aa9ae67bddbee704f5657b5b0e2a0f7025e8cf261bd3820816

    SHA512

    4c8f4e789376af4748159bcf59274e1b0662c6348ccd8b931a40931cd78a8a365f0b11e16194ba0804f82a874a8a4d1d4700baaadd549cd78fae49e0ef24c7c6

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsz0006Rk.exe

    Filesize

    417KB

    MD5

    164d2f235e8d4bcca5db3657734bc0d2

    SHA1

    dcc6f678e80436b0c707473c34c9d4fc3bf1d043

    SHA256

    27914ab152be17aa9ae67bddbee704f5657b5b0e2a0f7025e8cf261bd3820816

    SHA512

    4c8f4e789376af4748159bcf59274e1b0662c6348ccd8b931a40931cd78a8a365f0b11e16194ba0804f82a874a8a4d1d4700baaadd549cd78fae49e0ef24c7c6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf23Ts42lB61.exe

    Filesize

    12KB

    MD5

    4e0ec18c1140e1960dd5d56954929480

    SHA1

    ee51b6fab015f08be46bcebaf27fc9a50fc99501

    SHA256

    01259d1593a3ead465f6f297ae27ac1a40ae649dfb6e84185e279af19b9e135f

    SHA512

    17a37eaa7c6e0ba61cdb996f2fbe6fd4be23de7417911f72eb530d29d2d7b9375161f4dea4d7dd292a28eff3cf5fb9fe194e8492d18fa435df0df8881bc2d249

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf23Ts42lB61.exe

    Filesize

    12KB

    MD5

    4e0ec18c1140e1960dd5d56954929480

    SHA1

    ee51b6fab015f08be46bcebaf27fc9a50fc99501

    SHA256

    01259d1593a3ead465f6f297ae27ac1a40ae649dfb6e84185e279af19b9e135f

    SHA512

    17a37eaa7c6e0ba61cdb996f2fbe6fd4be23de7417911f72eb530d29d2d7b9375161f4dea4d7dd292a28eff3cf5fb9fe194e8492d18fa435df0df8881bc2d249

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf07Zy43jF80.exe

    Filesize

    419KB

    MD5

    6b48a9a5ca542b20633aff65ae0e882a

    SHA1

    c5e08fe68b82b937492e9686347567a37d606a48

    SHA256

    763b078fafe64dce994f8843a962741a00784eb2adcd8de0a1865f459e454355

    SHA512

    05e452f2b6540bc566b8d3b956c1e1ca8b645be991583374a559bd84fcd13c1ec79526a5b7dfb01369b0120793d1ac6aa4b5b956a5311ac504ed79cd0ea9e2e5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf07Zy43jF80.exe

    Filesize

    419KB

    MD5

    6b48a9a5ca542b20633aff65ae0e882a

    SHA1

    c5e08fe68b82b937492e9686347567a37d606a48

    SHA256

    763b078fafe64dce994f8843a962741a00784eb2adcd8de0a1865f459e454355

    SHA512

    05e452f2b6540bc566b8d3b956c1e1ca8b645be991583374a559bd84fcd13c1ec79526a5b7dfb01369b0120793d1ac6aa4b5b956a5311ac504ed79cd0ea9e2e5

  • memory/2984-135-0x00000000001B0000-0x00000000001BA000-memory.dmp

    Filesize

    40KB

  • memory/3908-141-0x0000000004A70000-0x0000000004AB6000-memory.dmp

    Filesize

    280KB

  • memory/3908-142-0x00000000073F0000-0x00000000078EE000-memory.dmp

    Filesize

    5.0MB

  • memory/3908-143-0x0000000002CC0000-0x0000000002D0B000-memory.dmp

    Filesize

    300KB

  • memory/3908-145-0x0000000004AF0000-0x0000000004B34000-memory.dmp

    Filesize

    272KB

  • memory/3908-144-0x00000000073E0000-0x00000000073F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-146-0x00000000073E0000-0x00000000073F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-147-0x00000000073E0000-0x00000000073F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-148-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-149-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-151-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-153-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-155-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-157-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-159-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-161-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-163-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-165-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-167-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-169-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-173-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-171-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-175-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-177-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-179-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-181-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-183-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-185-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-187-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-189-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-191-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-193-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-195-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-197-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-199-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-201-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-203-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-205-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-207-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-209-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-211-0x0000000004AF0000-0x0000000004B2E000-memory.dmp

    Filesize

    248KB

  • memory/3908-1054-0x0000000007F00000-0x0000000008506000-memory.dmp

    Filesize

    6.0MB

  • memory/3908-1055-0x0000000007280000-0x000000000738A000-memory.dmp

    Filesize

    1.0MB

  • memory/3908-1056-0x00000000073A0000-0x00000000073B2000-memory.dmp

    Filesize

    72KB

  • memory/3908-1057-0x00000000078F0000-0x000000000792E000-memory.dmp

    Filesize

    248KB

  • memory/3908-1058-0x0000000007A30000-0x0000000007A7B000-memory.dmp

    Filesize

    300KB

  • memory/3908-1059-0x00000000073E0000-0x00000000073F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-1061-0x0000000007BB0000-0x0000000007C42000-memory.dmp

    Filesize

    584KB

  • memory/3908-1062-0x0000000007C50000-0x0000000007CB6000-memory.dmp

    Filesize

    408KB

  • memory/3908-1063-0x00000000073E0000-0x00000000073F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-1064-0x00000000073E0000-0x00000000073F0000-memory.dmp

    Filesize

    64KB

  • memory/3908-1065-0x0000000008A60000-0x0000000008AD6000-memory.dmp

    Filesize

    472KB

  • memory/3908-1066-0x0000000008AE0000-0x0000000008B30000-memory.dmp

    Filesize

    320KB

  • memory/3908-1067-0x0000000008CA0000-0x0000000008E62000-memory.dmp

    Filesize

    1.8MB

  • memory/3908-1068-0x0000000008E70000-0x000000000939C000-memory.dmp

    Filesize

    5.2MB

  • memory/4652-1074-0x0000000000460000-0x0000000000492000-memory.dmp

    Filesize

    200KB

  • memory/4652-1075-0x0000000004D80000-0x0000000004DCB000-memory.dmp

    Filesize

    300KB

  • memory/4652-1076-0x0000000002750000-0x0000000002760000-memory.dmp

    Filesize

    64KB