Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
77s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
-
submitted
09/03/2023, 18:06 UTC
General
-
Target
0b9e27416b5a34c7b7ab25b61a2b4c598d2e0ff5683e23fe59a7c60fa7ecfecc.exe
-
Size
551KB
-
MD5
08399fbd2b2bfb73d66d93bdda8b7d48
-
SHA1
4a01afecf211de913c551a697160b94c7ec229c6
-
SHA256
0b9e27416b5a34c7b7ab25b61a2b4c598d2e0ff5683e23fe59a7c60fa7ecfecc
-
SHA512
36d58277ddb0a65e82948995c0949724d6b353b7c8b0eba16fa6c8e489018a4eb055d69c36c304452b79a1a1554ab0a70b69d4ccace9c9fb55414295e400cd93
-
SSDEEP
12288:vMrey90ooJtTcJaWHcC9qWRP2XeUS3d7NAKSs:hyboLs8ul4XTiNAKL
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
dezik
193.56.146.220:4174
-
auth_value
d39f21dca8edc10800b036ab83f4d75e
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b9e27416b5a34c7b7ab25b61a2b4c598d2e0ff5683e23fe59a7c60fa7ecfecc.exe"C:\Users\Admin\AppData\Local\Temp\0b9e27416b5a34c7b7ab25b61a2b4c598d2e0ff5683e23fe59a7c60fa7ecfecc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7817.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nice7817.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1163pI.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b1163pI.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c84WG97.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c84WG97.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4224 -s 13444⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dFuRP83.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dFuRP83.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4224 -ip 42241⤵
Network
-
DNS133.211.185.52.in-addr.arpaRemote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse -
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS28.20.233.193.in-addr.arpaRemote address:8.8.8.8:53Request28.20.233.193.in-addr.arpaIN PTRResponse
-
DNS220.146.56.193.in-addr.arpaRemote address:8.8.8.8:53Request220.146.56.193.in-addr.arpaIN PTRResponse
-
DNS199.176.139.52.in-addr.arpaRemote address:8.8.8.8:53Request199.176.139.52.in-addr.arpaIN PTRResponse
-
DNS113.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request113.238.32.23.in-addr.arpaIN PTRResponse113.238.32.23.in-addr.arpaIN PTRa23-32-238-113deploystaticakamaitechnologiescom
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS233.141.123.20.in-addr.arpaRemote address:8.8.8.8:53Request233.141.123.20.in-addr.arpaIN PTRResponse
-
193.233.20.28:4125 -
193.56.146.220:4174 -
20.189.173.2:443
-
209.197.3.8:80
-
173.223.113.164:443 -
204.79.197.203:80
-
8.238.177.126:80
-
8.8.8.8:53133.211.185.52.in-addr.arpadns
DNS Request
133.211.185.52.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5328.20.233.193.in-addr.arpadns
DNS Request
28.20.233.193.in-addr.arpa
-
8.8.8.8:53220.146.56.193.in-addr.arpadns
DNS Request
220.146.56.193.in-addr.arpa
-
8.8.8.8:53199.176.139.52.in-addr.arpadns
DNS Request
199.176.139.52.in-addr.arpa
-
8.8.8.8:53113.238.32.23.in-addr.arpadns
DNS Request
113.238.32.23.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53233.141.123.20.in-addr.arpadns
DNS Request
233.141.123.20.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD592f2a148b8f701e50e2f838f73d4d7b7
SHA1324d8546e35d4f4285cac15b21620299ba5cb023
SHA2569ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04
SHA5123300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c
-
Filesize
175KB
MD592f2a148b8f701e50e2f838f73d4d7b7
SHA1324d8546e35d4f4285cac15b21620299ba5cb023
SHA2569ad66388140ef3b4a7c2918eb3c9083dd80396949f385dd6d17c28f97cf14f04
SHA5123300c7606f872e75deaff924ee77fcd975e515a0dbca907ddd16b25910f250c6b8c46c6cabda3ac4780a8dce5fb9a70bd0c4c184f649cd5375fb6278b2a0ea6c
-
Filesize
406KB
MD56d71f9388acecd60554cf4817e1bbd2a
SHA1ca40b04f3b5f50a015d697882de08dd8ff00532b
SHA2569db10788ffa62dedce8030529edf9d7d80a102f3c994b244a0e842d2b3ba07d4
SHA512fc7160003015796614c6c13abda78eb84fbdd48f4ccc11b58c030d16883c1eff59a336d3de61f1259237fabaa3cddbc2c0cce8f83ade7625f78be08d54a64945
-
Filesize
406KB
MD56d71f9388acecd60554cf4817e1bbd2a
SHA1ca40b04f3b5f50a015d697882de08dd8ff00532b
SHA2569db10788ffa62dedce8030529edf9d7d80a102f3c994b244a0e842d2b3ba07d4
SHA512fc7160003015796614c6c13abda78eb84fbdd48f4ccc11b58c030d16883c1eff59a336d3de61f1259237fabaa3cddbc2c0cce8f83ade7625f78be08d54a64945
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
373KB
MD5dd7930d20da878defc3aafb3245b959d
SHA1231d425066fdcab6a39deec4da1137562c137377
SHA2563be662de8c33cc9ba26027c8fedde6cf95366f8c69dbb7eb1d1eac7820421144
SHA512d0c9dc313c444a8a8fbc8fc5dc5f67dded8b7bc6997affecda16cde59b799b6ffa9730436002191fc1ad0663cf8fafeac3d1c992c5f793153f280a97565132e0
-
Filesize
373KB
MD5dd7930d20da878defc3aafb3245b959d
SHA1231d425066fdcab6a39deec4da1137562c137377
SHA2563be662de8c33cc9ba26027c8fedde6cf95366f8c69dbb7eb1d1eac7820421144
SHA512d0c9dc313c444a8a8fbc8fc5dc5f67dded8b7bc6997affecda16cde59b799b6ffa9730436002191fc1ad0663cf8fafeac3d1c992c5f793153f280a97565132e0
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
5.6MB
-
Filesize
300KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
40KB