Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    79s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2023, 05:50

General

  • Target

    3e5aaef2072c5685689e5694b52739ea6965286014228318534cf4ed1a941705.exe

  • Size

    577KB

  • MD5

    91732109cdc1ded2b7c0f6e9449a1cf1

  • SHA1

    8dfd8444944b6a98fbb3cca3f2aedd770bfca66d

  • SHA256

    3e5aaef2072c5685689e5694b52739ea6965286014228318534cf4ed1a941705

  • SHA512

    c4aed9412a12ac79a19c2c07108f2d6a83d93f7a5018117e8a31532f913e34bb35589d1f292497882ce4bf1112e26fd79d8dd48757a8ce8a0835f4a8e76fd489

  • SSDEEP

    12288:pMrDy90Rahimz7AuxqVpoAli/LvowdlypGCTK3az4rANUi00vPw:qyosVAuxY+GiD10K3az4yUQA

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e5aaef2072c5685689e5694b52739ea6965286014228318534cf4ed1a941705.exe
    "C:\Users\Admin\AppData\Local\Temp\3e5aaef2072c5685689e5694b52739ea6965286014228318534cf4ed1a941705.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r9012NX.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r9012NX.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1080 -s 1084
        3⤵
        • Program crash
        PID:4300
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w33Ua87.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w33Ua87.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1956
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 1348
        3⤵
        • Program crash
        PID:4108
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1080 -ip 1080
    1⤵
      PID:4996
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1956 -ip 1956
      1⤵
        PID:2356

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r9012NX.exe

        Filesize

        322KB

        MD5

        8141937b23cd1895e561d8e90fdeeff3

        SHA1

        6f810e9e480564f5837461f8ccdd07c951a1bece

        SHA256

        ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6

        SHA512

        40957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\r9012NX.exe

        Filesize

        322KB

        MD5

        8141937b23cd1895e561d8e90fdeeff3

        SHA1

        6f810e9e480564f5837461f8ccdd07c951a1bece

        SHA256

        ddda10348c77cf0a1539c3a42ce4f71e2c1895ab9b77348256e0a1f01c0936b6

        SHA512

        40957cd33c4be1dab98ac0c40424c868aa3be6f6265fa28df050e5a4844ac6324acb93770bc6cb7cafedabc93fab9b9179a6e6525f6b3dd6fa9e31b4d5da5bec

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w33Ua87.exe

        Filesize

        323KB

        MD5

        5b3c0d8790df09f4b9c509263e37bffa

        SHA1

        f6bfd8ab2eb8b89284440eea220793e7601cb847

        SHA256

        e30dff8ec3dd23f65c3fcb72e11b4243176e773d9423571cece524b4df5a9a6b

        SHA512

        6979b822e2eb341c46aad76301ddecdfff95f4347b94276110bb8fab1911fc351f4b71bae88d44b2020bdbc4f7bd1e3d8909dfb4941de8677249ea5648c2ec08

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w33Ua87.exe

        Filesize

        323KB

        MD5

        5b3c0d8790df09f4b9c509263e37bffa

        SHA1

        f6bfd8ab2eb8b89284440eea220793e7601cb847

        SHA256

        e30dff8ec3dd23f65c3fcb72e11b4243176e773d9423571cece524b4df5a9a6b

        SHA512

        6979b822e2eb341c46aad76301ddecdfff95f4347b94276110bb8fab1911fc351f4b71bae88d44b2020bdbc4f7bd1e3d8909dfb4941de8677249ea5648c2ec08

      • memory/1080-141-0x0000000004A60000-0x0000000005004000-memory.dmp

        Filesize

        5.6MB

      • memory/1080-142-0x00000000004E0000-0x000000000050D000-memory.dmp

        Filesize

        180KB

      • memory/1080-143-0x00000000008C0000-0x00000000008D0000-memory.dmp

        Filesize

        64KB

      • memory/1080-144-0x00000000008C0000-0x00000000008D0000-memory.dmp

        Filesize

        64KB

      • memory/1080-145-0x00000000008C0000-0x00000000008D0000-memory.dmp

        Filesize

        64KB

      • memory/1080-146-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-147-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-149-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-151-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-153-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-155-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-157-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-159-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-161-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-163-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-165-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-167-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-171-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-169-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-173-0x0000000005010000-0x0000000005022000-memory.dmp

        Filesize

        72KB

      • memory/1080-174-0x0000000000400000-0x00000000004D4000-memory.dmp

        Filesize

        848KB

      • memory/1080-175-0x00000000008C0000-0x00000000008D0000-memory.dmp

        Filesize

        64KB

      • memory/1080-176-0x00000000008C0000-0x00000000008D0000-memory.dmp

        Filesize

        64KB

      • memory/1080-178-0x0000000000400000-0x00000000004D4000-memory.dmp

        Filesize

        848KB

      • memory/1956-184-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-183-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-186-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-188-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-190-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-192-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-194-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-196-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-198-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-200-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-202-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-204-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-206-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-208-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-210-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-212-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-214-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-216-0x0000000004FD0000-0x000000000500E000-memory.dmp

        Filesize

        248KB

      • memory/1956-467-0x00000000020D0000-0x000000000211B000-memory.dmp

        Filesize

        300KB

      • memory/1956-468-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-471-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-473-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-1093-0x00000000051B0000-0x00000000057C8000-memory.dmp

        Filesize

        6.1MB

      • memory/1956-1094-0x0000000005850000-0x000000000595A000-memory.dmp

        Filesize

        1.0MB

      • memory/1956-1095-0x0000000005990000-0x00000000059A2000-memory.dmp

        Filesize

        72KB

      • memory/1956-1096-0x00000000059B0000-0x00000000059EC000-memory.dmp

        Filesize

        240KB

      • memory/1956-1097-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-1098-0x0000000005CA0000-0x0000000005D06000-memory.dmp

        Filesize

        408KB

      • memory/1956-1099-0x0000000006370000-0x0000000006402000-memory.dmp

        Filesize

        584KB

      • memory/1956-1101-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-1102-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-1103-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB

      • memory/1956-1104-0x0000000006440000-0x00000000064B6000-memory.dmp

        Filesize

        472KB

      • memory/1956-1105-0x00000000064D0000-0x0000000006520000-memory.dmp

        Filesize

        320KB

      • memory/1956-1106-0x0000000006680000-0x0000000006842000-memory.dmp

        Filesize

        1.8MB

      • memory/1956-1107-0x0000000006850000-0x0000000006D7C000-memory.dmp

        Filesize

        5.2MB

      • memory/1956-1108-0x0000000002290000-0x00000000022A0000-memory.dmp

        Filesize

        64KB