Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    90s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2023, 02:04

General

  • Target

    20794860791f8b12672eb6a15666b3643cafca3b284d874c89b7938ebf54d36f.exe

  • Size

    576KB

  • MD5

    ccff72bb1ee962025c17425eb519a845

  • SHA1

    ccb927256cf9f9f9c24bf37e21129347c5dc3005

  • SHA256

    20794860791f8b12672eb6a15666b3643cafca3b284d874c89b7938ebf54d36f

  • SHA512

    2e02341d224fcc60d3ce9cc44de8715f835fe34007d44853b0b42ee3282c816a5b075f05f43a22adf11bfeb4f4f39344d0ed1d6a85181a9c450dcd9e33d6322f

  • SSDEEP

    12288:uMrQy90iahimz7AuxqVkTqNzTMly6mjfFCBy9D57:WyXsVAuxYkTq5ufMfIg97

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20794860791f8b12672eb6a15666b3643cafca3b284d874c89b7938ebf54d36f.exe
    "C:\Users\Admin\AppData\Local\Temp\20794860791f8b12672eb6a15666b3643cafca3b284d874c89b7938ebf54d36f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r4886Al.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r4886Al.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4288
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 1084
        3⤵
        • Program crash
        PID:5008
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w57JJ00.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w57JJ00.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2432
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1360
        3⤵
        • Program crash
        PID:3576
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4288 -ip 4288
    1⤵
      PID:3100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2432 -ip 2432
      1⤵
        PID:3604

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r4886Al.exe

        Filesize

        322KB

        MD5

        8141937b23cd1895e561d8e90fdeeff3

        SHA1

        6f810e9e480564f5837461f8ccdd07c951a1bece

        SHA256

        ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6

        SHA512

        40957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r4886Al.exe

        Filesize

        322KB

        MD5

        8141937b23cd1895e561d8e90fdeeff3

        SHA1

        6f810e9e480564f5837461f8ccdd07c951a1bece

        SHA256

        ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6

        SHA512

        40957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w57JJ00.exe

        Filesize

        323KB

        MD5

        c3b453a32b1a8370ce797131b1a03bde

        SHA1

        20929563ff413dce93e61f472451d17cae09faa6

        SHA256

        011a59f49d5d2c8965bad3829cf84a924b6611e67cf7f3d31bb2031ca61ed9af

        SHA512

        f61449bba5a6d3afe47e3940f9a6376d33bcfe38a809bf27a72e8250fa12d049ab44a8da39512bcbe5abcfc969b2187f8590bfad79d49c3b3c30711aa3efe1ad

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w57JJ00.exe

        Filesize

        323KB

        MD5

        c3b453a32b1a8370ce797131b1a03bde

        SHA1

        20929563ff413dce93e61f472451d17cae09faa6

        SHA256

        011a59f49d5d2c8965bad3829cf84a924b6611e67cf7f3d31bb2031ca61ed9af

        SHA512

        f61449bba5a6d3afe47e3940f9a6376d33bcfe38a809bf27a72e8250fa12d049ab44a8da39512bcbe5abcfc969b2187f8590bfad79d49c3b3c30711aa3efe1ad

      • memory/2432-492-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-1093-0x0000000005100000-0x0000000005718000-memory.dmp

        Filesize

        6.1MB

      • memory/2432-1108-0x0000000008100000-0x0000000008150000-memory.dmp

        Filesize

        320KB

      • memory/2432-1107-0x0000000008070000-0x00000000080E6000-memory.dmp

        Filesize

        472KB

      • memory/2432-1106-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-1105-0x0000000006600000-0x0000000006B2C000-memory.dmp

        Filesize

        5.2MB

      • memory/2432-1104-0x0000000006420000-0x00000000065E2000-memory.dmp

        Filesize

        1.8MB

      • memory/2432-1103-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-1102-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-1101-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-1099-0x0000000005C00000-0x0000000005C66000-memory.dmp

        Filesize

        408KB

      • memory/2432-1098-0x0000000005B60000-0x0000000005BF2000-memory.dmp

        Filesize

        584KB

      • memory/2432-1097-0x0000000005870000-0x00000000058AC000-memory.dmp

        Filesize

        240KB

      • memory/2432-1096-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-1095-0x0000000005850000-0x0000000005862000-memory.dmp

        Filesize

        72KB

      • memory/2432-1094-0x0000000005720000-0x000000000582A000-memory.dmp

        Filesize

        1.0MB

      • memory/2432-194-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-489-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-487-0x00000000026B0000-0x00000000026C0000-memory.dmp

        Filesize

        64KB

      • memory/2432-485-0x00000000005C0000-0x000000000060B000-memory.dmp

        Filesize

        300KB

      • memory/2432-216-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-214-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-212-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-210-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-184-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-186-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-183-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-188-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-190-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-198-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-208-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-204-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-192-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-200-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-202-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-196-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/2432-206-0x0000000002620000-0x000000000265E000-memory.dmp

        Filesize

        248KB

      • memory/4288-149-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-174-0x0000000000400000-0x00000000004D4000-memory.dmp

        Filesize

        848KB

      • memory/4288-143-0x0000000004C00000-0x0000000004C10000-memory.dmp

        Filesize

        64KB

      • memory/4288-178-0x0000000000400000-0x00000000004D4000-memory.dmp

        Filesize

        848KB

      • memory/4288-176-0x0000000004C00000-0x0000000004C10000-memory.dmp

        Filesize

        64KB

      • memory/4288-175-0x0000000004C00000-0x0000000004C10000-memory.dmp

        Filesize

        64KB

      • memory/4288-144-0x0000000004C00000-0x0000000004C10000-memory.dmp

        Filesize

        64KB

      • memory/4288-141-0x0000000004C10000-0x00000000051B4000-memory.dmp

        Filesize

        5.6MB

      • memory/4288-173-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-171-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-142-0x00000000005C0000-0x00000000005ED000-memory.dmp

        Filesize

        180KB

      • memory/4288-169-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-157-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-167-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-161-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-159-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-163-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-155-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-153-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-151-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-165-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-147-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-146-0x0000000004A40000-0x0000000004A52000-memory.dmp

        Filesize

        72KB

      • memory/4288-145-0x0000000004C00000-0x0000000004C10000-memory.dmp

        Filesize

        64KB