Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2023, 23:08

General

  • Target

    00a3187ffedd9cabd11767b07407b45d1bcff453a3cbe139e8b2ad5080835dc7.exe

  • Size

    557KB

  • MD5

    bc63870b1b471b7bf32fd377c1d7123a

  • SHA1

    9a9413a17889bed90aaa66549bfa8f7764d3323a

  • SHA256

    00a3187ffedd9cabd11767b07407b45d1bcff453a3cbe139e8b2ad5080835dc7

  • SHA512

    6369c8140a410036df41e2fb456c9adfed95cf99592a6fc911cecefc85eab11b9b361a6598bfed72f472d3f7025c932b33e0dd3178483328eb84eaba2c5a6b3c

  • SSDEEP

    12288:wMrDy90nBHUT8H1jleEOmthrDUVpTm+aBl4utVqS:jyWBTjleteHTx4utVb

Malware Config

Extracted

Family

redline

Botnet

fud

C2

193.233.20.27:4123

Attributes
  • auth_value

    cddc991efd6918ad5321d80dac884b40

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 36 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\00a3187ffedd9cabd11767b07407b45d1bcff453a3cbe139e8b2ad5080835dc7.exe
    "C:\Users\Admin\AppData\Local\Temp\00a3187ffedd9cabd11767b07407b45d1bcff453a3cbe139e8b2ad5080835dc7.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWd2757Rh.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWd2757Rh.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1668
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78hI34mb07.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78hI34mb07.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:1664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWd2757Rh.exe

    Filesize

    412KB

    MD5

    39471fbd65737e3450ef9e47f54311a8

    SHA1

    834d17c2553ab89c323ce541de875649d2153856

    SHA256

    6e8377ed5a7a13d6079729d82ffbc3a52d178ff46cb5b81b8fea52fdc030d114

    SHA512

    df05455adb5b9cdc5344248bd2a44fe8abcec18ca200d05099d83695a3759ecd420e1dcb2ac1d7e6d508a3676005e8119d006907d45f9938d504fa4850c6ffd6

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWd2757Rh.exe

    Filesize

    412KB

    MD5

    39471fbd65737e3450ef9e47f54311a8

    SHA1

    834d17c2553ab89c323ce541de875649d2153856

    SHA256

    6e8377ed5a7a13d6079729d82ffbc3a52d178ff46cb5b81b8fea52fdc030d114

    SHA512

    df05455adb5b9cdc5344248bd2a44fe8abcec18ca200d05099d83695a3759ecd420e1dcb2ac1d7e6d508a3676005e8119d006907d45f9938d504fa4850c6ffd6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78hI34mb07.exe

    Filesize

    11KB

    MD5

    20093214719eff8ea5e487fc6e355e2f

    SHA1

    d28a6a912f5b54ef969763119c4a1bec3234deba

    SHA256

    340ec267276f0c7ce986f2d7341b3ed026472d6af0da81b256993b343616fd4f

    SHA512

    735ac07b662da46487223eaffd58d1056ed76c4400e40c67524f7b14f216380d68074f8648b04185df8341a53807687ac4db7aae9b44a199d5ae3440145f2907

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78hI34mb07.exe

    Filesize

    11KB

    MD5

    20093214719eff8ea5e487fc6e355e2f

    SHA1

    d28a6a912f5b54ef969763119c4a1bec3234deba

    SHA256

    340ec267276f0c7ce986f2d7341b3ed026472d6af0da81b256993b343616fd4f

    SHA512

    735ac07b662da46487223eaffd58d1056ed76c4400e40c67524f7b14f216380d68074f8648b04185df8341a53807687ac4db7aae9b44a199d5ae3440145f2907

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe

    Filesize

    409KB

    MD5

    931575b864d1b9cc3d4c75de1b8927be

    SHA1

    965ce099aae8d1a156fabb8f5a35966f94193141

    SHA256

    39b3bb1a3331fb51e5da43e373be13e1de7d448601059131407cfdbb19c68bca

    SHA512

    b7abd36d6720e85901547681a81ae8d4e2e036a6391a8f9aa744d74815a55f9a7590b5a9c01a33d9a328558949feb4b45549e6a278750feef842afad24489878

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe

    Filesize

    409KB

    MD5

    931575b864d1b9cc3d4c75de1b8927be

    SHA1

    965ce099aae8d1a156fabb8f5a35966f94193141

    SHA256

    39b3bb1a3331fb51e5da43e373be13e1de7d448601059131407cfdbb19c68bca

    SHA512

    b7abd36d6720e85901547681a81ae8d4e2e036a6391a8f9aa744d74815a55f9a7590b5a9c01a33d9a328558949feb4b45549e6a278750feef842afad24489878

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe

    Filesize

    409KB

    MD5

    931575b864d1b9cc3d4c75de1b8927be

    SHA1

    965ce099aae8d1a156fabb8f5a35966f94193141

    SHA256

    39b3bb1a3331fb51e5da43e373be13e1de7d448601059131407cfdbb19c68bca

    SHA512

    b7abd36d6720e85901547681a81ae8d4e2e036a6391a8f9aa744d74815a55f9a7590b5a9c01a33d9a328558949feb4b45549e6a278750feef842afad24489878

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWd2757Rh.exe

    Filesize

    412KB

    MD5

    39471fbd65737e3450ef9e47f54311a8

    SHA1

    834d17c2553ab89c323ce541de875649d2153856

    SHA256

    6e8377ed5a7a13d6079729d82ffbc3a52d178ff46cb5b81b8fea52fdc030d114

    SHA512

    df05455adb5b9cdc5344248bd2a44fe8abcec18ca200d05099d83695a3759ecd420e1dcb2ac1d7e6d508a3676005e8119d006907d45f9938d504fa4850c6ffd6

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\vhWd2757Rh.exe

    Filesize

    412KB

    MD5

    39471fbd65737e3450ef9e47f54311a8

    SHA1

    834d17c2553ab89c323ce541de875649d2153856

    SHA256

    6e8377ed5a7a13d6079729d82ffbc3a52d178ff46cb5b81b8fea52fdc030d114

    SHA512

    df05455adb5b9cdc5344248bd2a44fe8abcec18ca200d05099d83695a3759ecd420e1dcb2ac1d7e6d508a3676005e8119d006907d45f9938d504fa4850c6ffd6

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78hI34mb07.exe

    Filesize

    11KB

    MD5

    20093214719eff8ea5e487fc6e355e2f

    SHA1

    d28a6a912f5b54ef969763119c4a1bec3234deba

    SHA256

    340ec267276f0c7ce986f2d7341b3ed026472d6af0da81b256993b343616fd4f

    SHA512

    735ac07b662da46487223eaffd58d1056ed76c4400e40c67524f7b14f216380d68074f8648b04185df8341a53807687ac4db7aae9b44a199d5ae3440145f2907

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe

    Filesize

    409KB

    MD5

    931575b864d1b9cc3d4c75de1b8927be

    SHA1

    965ce099aae8d1a156fabb8f5a35966f94193141

    SHA256

    39b3bb1a3331fb51e5da43e373be13e1de7d448601059131407cfdbb19c68bca

    SHA512

    b7abd36d6720e85901547681a81ae8d4e2e036a6391a8f9aa744d74815a55f9a7590b5a9c01a33d9a328558949feb4b45549e6a278750feef842afad24489878

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe

    Filesize

    409KB

    MD5

    931575b864d1b9cc3d4c75de1b8927be

    SHA1

    965ce099aae8d1a156fabb8f5a35966f94193141

    SHA256

    39b3bb1a3331fb51e5da43e373be13e1de7d448601059131407cfdbb19c68bca

    SHA512

    b7abd36d6720e85901547681a81ae8d4e2e036a6391a8f9aa744d74815a55f9a7590b5a9c01a33d9a328558949feb4b45549e6a278750feef842afad24489878

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\tf13EY48Ab19.exe

    Filesize

    409KB

    MD5

    931575b864d1b9cc3d4c75de1b8927be

    SHA1

    965ce099aae8d1a156fabb8f5a35966f94193141

    SHA256

    39b3bb1a3331fb51e5da43e373be13e1de7d448601059131407cfdbb19c68bca

    SHA512

    b7abd36d6720e85901547681a81ae8d4e2e036a6391a8f9aa744d74815a55f9a7590b5a9c01a33d9a328558949feb4b45549e6a278750feef842afad24489878

  • memory/1664-142-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-138-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-84-0x0000000002FC0000-0x0000000003004000-memory.dmp

    Filesize

    272KB

  • memory/1664-85-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-96-0x0000000000240000-0x000000000028B000-memory.dmp

    Filesize

    300KB

  • memory/1664-97-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/1664-108-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-116-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-120-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-122-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-126-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-130-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-136-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-996-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/1664-150-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-146-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-148-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-144-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-140-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-83-0x0000000002D70000-0x0000000002DB6000-memory.dmp

    Filesize

    280KB

  • memory/1664-134-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-132-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-128-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-124-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-118-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-112-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-114-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-110-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-106-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-104-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-102-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-100-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-98-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-94-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-92-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-90-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-88-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-86-0x0000000002FC0000-0x0000000002FFE000-memory.dmp

    Filesize

    248KB

  • memory/1664-993-0x0000000004AC0000-0x0000000004B00000-memory.dmp

    Filesize

    256KB

  • memory/1736-72-0x0000000000360000-0x000000000036A000-memory.dmp

    Filesize

    40KB