Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    88s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2023, 17:31

General

  • Target

    79cbdcbc3657f42e3e23e0347cc380db70648317cc497f9f92c4341dafae3b18.exe

  • Size

    717KB

  • MD5

    b6f69d073ca957a77fa9fd5c2b48f840

  • SHA1

    6e9e3dcc63bf6d7ccc286c4c001e5c63c70a7b4f

  • SHA256

    79cbdcbc3657f42e3e23e0347cc380db70648317cc497f9f92c4341dafae3b18

  • SHA512

    f0fc6875d3b1c1f83f6285e502dd7eb3ee71a3a53e775692fa70c836fa04ff05572de3d055a511ba6c2c9295139d59b9e2460410a538105ff71b86d4b1dd333d

  • SSDEEP

    12288:PMrBy90J/Ax/XQFupIA/aagZM//hou1/2uD5QnG4fLUQl9Z:yyIAJuuh3mIezDZ

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Extracted

Family

redline

Botnet

misha

C2

193.56.146.11:4173

Attributes
  • auth_value

    e17e441c954db214b94a603a7b0b1aea

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79cbdcbc3657f42e3e23e0347cc380db70648317cc497f9f92c4341dafae3b18.exe
    "C:\Users\Admin\AppData\Local\Temp\79cbdcbc3657f42e3e23e0347cc380db70648317cc497f9f92c4341dafae3b18.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMM8321fs.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMM8321fs.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3164
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4331li.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4331li.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2488
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2488 -s 992
          4⤵
          • Program crash
          PID:4376
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w06MO52.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w06MO52.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1368
          4⤵
          • Program crash
          PID:940
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xzhGF00.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xzhGF00.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3188
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2488 -ip 2488
    1⤵
      PID:2556
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2400 -ip 2400
      1⤵
        PID:3972

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xzhGF00.exe

        Filesize

        175KB

        MD5

        fb6b1dfc1d31819df66b4eba004f4f1e

        SHA1

        8fb4085acc6bdac0c653130d20ccf87dc0a4bc16

        SHA256

        4a8cf958110e605398244c588878680f5f367bf064573a69fded3f4ca70c7549

        SHA512

        270f0208fac6330d413709de2f1aa348f20e434bb70b886a96e7db87f74607c9dcbee92b458ea375ca9d22a89af46b31655b84d6f26fac3d12e63f8242d41f3a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xzhGF00.exe

        Filesize

        175KB

        MD5

        fb6b1dfc1d31819df66b4eba004f4f1e

        SHA1

        8fb4085acc6bdac0c653130d20ccf87dc0a4bc16

        SHA256

        4a8cf958110e605398244c588878680f5f367bf064573a69fded3f4ca70c7549

        SHA512

        270f0208fac6330d413709de2f1aa348f20e434bb70b886a96e7db87f74607c9dcbee92b458ea375ca9d22a89af46b31655b84d6f26fac3d12e63f8242d41f3a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMM8321fs.exe

        Filesize

        572KB

        MD5

        f94453b051b307cd4c8779f692cf1e60

        SHA1

        1c445031e84c2122bd88f3bcfe6172f4806f11d6

        SHA256

        f022ca56d6ee3d75482b975350d94dc593fd4f70dbcaf5de88ade42ea6aca3d7

        SHA512

        1bb9fefde7421d20241237d94cdc50261ef1edb0764f589c935c407294fbe28cf64b6a6f65d9be9ab1d454e5b9f6be1730c8c738754002cdf66232d7070599cd

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ycMM8321fs.exe

        Filesize

        572KB

        MD5

        f94453b051b307cd4c8779f692cf1e60

        SHA1

        1c445031e84c2122bd88f3bcfe6172f4806f11d6

        SHA256

        f022ca56d6ee3d75482b975350d94dc593fd4f70dbcaf5de88ade42ea6aca3d7

        SHA512

        1bb9fefde7421d20241237d94cdc50261ef1edb0764f589c935c407294fbe28cf64b6a6f65d9be9ab1d454e5b9f6be1730c8c738754002cdf66232d7070599cd

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4331li.exe

        Filesize

        363KB

        MD5

        5f9106c1a4ae0150887ac3eadc521f31

        SHA1

        b7c59f033e09829e70ebf380ef9c33aff98d2bf4

        SHA256

        ddda2d12c18f4944b44af8c6bb030ae608060d087483c423acf217c4c4ed5411

        SHA512

        80ab71ecb332f2316abf7cb73c4811bf2162c2e95fc0670fcd8d26370158e2b2f342328ece12e9edeed90a7568d24d0048bdb9ee3ea928fd80d1499851c5caf3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r4331li.exe

        Filesize

        363KB

        MD5

        5f9106c1a4ae0150887ac3eadc521f31

        SHA1

        b7c59f033e09829e70ebf380ef9c33aff98d2bf4

        SHA256

        ddda2d12c18f4944b44af8c6bb030ae608060d087483c423acf217c4c4ed5411

        SHA512

        80ab71ecb332f2316abf7cb73c4811bf2162c2e95fc0670fcd8d26370158e2b2f342328ece12e9edeed90a7568d24d0048bdb9ee3ea928fd80d1499851c5caf3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w06MO52.exe

        Filesize

        365KB

        MD5

        845708fe8e574bb4ae832556c0598a40

        SHA1

        9c85ea1653e0a6cd465356bba04ea0b5b106a7e3

        SHA256

        03d64d5b343e6d39c98916b02fcaf9a90bf0eef42e35e3b9d6dcb1ad735ec639

        SHA512

        edf2fd1ec51e3d3cb9d3e00b20a644ee2f375b52156c445fea3e1b565d387bf8f217824bfeddf043119343947a91a2e5470fb3ac572f0160cbf0f1894ba20a89

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\w06MO52.exe

        Filesize

        365KB

        MD5

        845708fe8e574bb4ae832556c0598a40

        SHA1

        9c85ea1653e0a6cd465356bba04ea0b5b106a7e3

        SHA256

        03d64d5b343e6d39c98916b02fcaf9a90bf0eef42e35e3b9d6dcb1ad735ec639

        SHA512

        edf2fd1ec51e3d3cb9d3e00b20a644ee2f375b52156c445fea3e1b565d387bf8f217824bfeddf043119343947a91a2e5470fb3ac572f0160cbf0f1894ba20a89

      • memory/2400-1102-0x00000000058C0000-0x00000000059CA000-memory.dmp

        Filesize

        1.0MB

      • memory/2400-1103-0x0000000005A00000-0x0000000005A12000-memory.dmp

        Filesize

        72KB

      • memory/2400-1117-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-1115-0x00000000069D0000-0x0000000006EFC000-memory.dmp

        Filesize

        5.2MB

      • memory/2400-1114-0x0000000006800000-0x00000000069C2000-memory.dmp

        Filesize

        1.8MB

      • memory/2400-1113-0x0000000006780000-0x00000000067D0000-memory.dmp

        Filesize

        320KB

      • memory/2400-1112-0x00000000066F0000-0x0000000006766000-memory.dmp

        Filesize

        472KB

      • memory/2400-1111-0x0000000005DB0000-0x0000000005E16000-memory.dmp

        Filesize

        408KB

      • memory/2400-1110-0x0000000005D10000-0x0000000005DA2000-memory.dmp

        Filesize

        584KB

      • memory/2400-1109-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-1108-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-1107-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-1105-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-1104-0x0000000005A20000-0x0000000005A5C000-memory.dmp

        Filesize

        240KB

      • memory/2400-200-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-1101-0x0000000005260000-0x0000000005878000-memory.dmp

        Filesize

        6.1MB

      • memory/2400-228-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-226-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-222-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-224-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-204-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-218-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-216-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-191-0x00000000006E0000-0x000000000072B000-memory.dmp

        Filesize

        300KB

      • memory/2400-192-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-193-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-195-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-194-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-198-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-196-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/2400-214-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-206-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-220-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-202-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-208-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-210-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2400-212-0x0000000002640000-0x000000000267E000-memory.dmp

        Filesize

        248KB

      • memory/2488-154-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-148-0x0000000007350000-0x00000000078F4000-memory.dmp

        Filesize

        5.6MB

      • memory/2488-152-0x0000000007340000-0x0000000007350000-memory.dmp

        Filesize

        64KB

      • memory/2488-172-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-184-0x0000000007340000-0x0000000007350000-memory.dmp

        Filesize

        64KB

      • memory/2488-183-0x0000000007340000-0x0000000007350000-memory.dmp

        Filesize

        64KB

      • memory/2488-182-0x0000000007340000-0x0000000007350000-memory.dmp

        Filesize

        64KB

      • memory/2488-181-0x0000000000400000-0x0000000002BC9000-memory.dmp

        Filesize

        39.8MB

      • memory/2488-180-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-150-0x0000000007340000-0x0000000007350000-memory.dmp

        Filesize

        64KB

      • memory/2488-178-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-170-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-151-0x0000000007340000-0x0000000007350000-memory.dmp

        Filesize

        64KB

      • memory/2488-176-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-153-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-168-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-166-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-164-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-162-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-160-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-158-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-156-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-174-0x0000000004DF0000-0x0000000004E02000-memory.dmp

        Filesize

        72KB

      • memory/2488-149-0x0000000002CA0000-0x0000000002CCD000-memory.dmp

        Filesize

        180KB

      • memory/2488-186-0x0000000000400000-0x0000000002BC9000-memory.dmp

        Filesize

        39.8MB

      • memory/3188-1122-0x00000000001F0000-0x0000000000222000-memory.dmp

        Filesize

        200KB

      • memory/3188-1123-0x0000000004D70000-0x0000000004D80000-memory.dmp

        Filesize

        64KB