Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    111s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2023, 20:05

General

  • Target

    0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe

  • Size

    786KB

  • MD5

    edc42044ab0ca79f2b7e7f4d9c6392e5

  • SHA1

    40dfd32d74c1c597c91895c6fcf5e87b06804bcc

  • SHA256

    0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f

  • SHA512

    751590d25daf9472fd0cef3535caeb5b7c4071d211a9f62a082ef9c4ffd72a6055ffe76355e7c57000b98bd227e7bd04f02d82e454b3543b30030cad15f900d4

  • SSDEEP

    24576:XyKeCXWnSfHrLyFiw5vrzVUQpqjypB9S:iRCGCK5DzV3qjC

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rita

C2

193.233.20.28:4125

Attributes
  • auth_value

    5cf1bcf41b0a2f3710619223451dfd3a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe
    "C:\Users\Admin\AppData\Local\Temp\0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice9081.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice9081.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8644.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8644.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2964
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5637RP.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5637RP.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2476
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c43Go35.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c43Go35.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 1084
            5⤵
            • Program crash
            PID:4652
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dNOOY32.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dNOOY32.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1096
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 1688
          4⤵
          • Program crash
          PID:3268
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e62gp44.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e62gp44.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:756
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 920 -ip 920
    1⤵
      PID:1652
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1096 -ip 1096
      1⤵
        PID:2056

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e62gp44.exe

        Filesize

        175KB

        MD5

        8b0ea3120d3d291045b26bcea5ccef54

        SHA1

        07ed9587057ae936ca0610051142a4add4f7b6aa

        SHA256

        6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

        SHA512

        6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e62gp44.exe

        Filesize

        175KB

        MD5

        8b0ea3120d3d291045b26bcea5ccef54

        SHA1

        07ed9587057ae936ca0610051142a4add4f7b6aa

        SHA256

        6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

        SHA512

        6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice9081.exe

        Filesize

        641KB

        MD5

        781477be5ea4eac778260ffa33d5ec78

        SHA1

        2a9c60da657164a657b8dd3891fc17d95b497f0f

        SHA256

        53566cda176900dd4fd349a061655112fc7eae46ab03d402f1f40cf0bb891fb2

        SHA512

        9507e720c429d1f859ee8aa7f6f00b2c0a3d551a3bde1b951f773fd1e1901573010edc8fcfd9bc4cf921ba6929a17590f10184c77b7db95efc694e0e26753a37

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice9081.exe

        Filesize

        641KB

        MD5

        781477be5ea4eac778260ffa33d5ec78

        SHA1

        2a9c60da657164a657b8dd3891fc17d95b497f0f

        SHA256

        53566cda176900dd4fd349a061655112fc7eae46ab03d402f1f40cf0bb891fb2

        SHA512

        9507e720c429d1f859ee8aa7f6f00b2c0a3d551a3bde1b951f773fd1e1901573010edc8fcfd9bc4cf921ba6929a17590f10184c77b7db95efc694e0e26753a37

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dNOOY32.exe

        Filesize

        294KB

        MD5

        cfca2843f22872eba40ba48206f6d93b

        SHA1

        7aeea0e3c73cd4cd4f7590bdcd0c5cc864d92951

        SHA256

        13f8235abe83aacb0b63626158668a343cd79f4f0d595b7dcf8af1111316ddee

        SHA512

        e741b91329158cff484f42912a0b42f85b064d0997bff87a42bb05d7a80e404ecd980b8a3c8a510a7bbc51f71df6e3db57cff90ddef53fb7cfe6735049e3c324

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dNOOY32.exe

        Filesize

        294KB

        MD5

        cfca2843f22872eba40ba48206f6d93b

        SHA1

        7aeea0e3c73cd4cd4f7590bdcd0c5cc864d92951

        SHA256

        13f8235abe83aacb0b63626158668a343cd79f4f0d595b7dcf8af1111316ddee

        SHA512

        e741b91329158cff484f42912a0b42f85b064d0997bff87a42bb05d7a80e404ecd980b8a3c8a510a7bbc51f71df6e3db57cff90ddef53fb7cfe6735049e3c324

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8644.exe

        Filesize

        321KB

        MD5

        dc5d4ca4890bba6045a1611889b765f8

        SHA1

        510b5e87803fc2ff39fa3ef2349d4bc04f037b27

        SHA256

        81a38c0a0fb05df8502d887fec243eb548ca82b850b34d8d9d0887bdf5fe43da

        SHA512

        36fb046b6e9c848d0140bc8b2c86824a81cd9c81b0206625f1eb0d6e7501f6733721cc562fcf422a2391496d21fe36fb70871cbc7d6f3a6d05154f3e8ec88358

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8644.exe

        Filesize

        321KB

        MD5

        dc5d4ca4890bba6045a1611889b765f8

        SHA1

        510b5e87803fc2ff39fa3ef2349d4bc04f037b27

        SHA256

        81a38c0a0fb05df8502d887fec243eb548ca82b850b34d8d9d0887bdf5fe43da

        SHA512

        36fb046b6e9c848d0140bc8b2c86824a81cd9c81b0206625f1eb0d6e7501f6733721cc562fcf422a2391496d21fe36fb70871cbc7d6f3a6d05154f3e8ec88358

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5637RP.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5637RP.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c43Go35.exe

        Filesize

        237KB

        MD5

        199301397975c341a703a697654fbd8c

        SHA1

        394a5817b1b7f82de3ae683e2f98eb07a8a4dcaf

        SHA256

        63a61edd4de5d0ce5a28c1596f0e202ee6edb214b53a3888a70b6aab983aa420

        SHA512

        9f8e82855834e8c3233641bd5855cf7a3bfa53732bb7d045206bbdf5a78c2b92cf2d20db7e3d0dafa67f5aec386786dc3762522cfaa0639894963fbfdcab0393

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c43Go35.exe

        Filesize

        237KB

        MD5

        199301397975c341a703a697654fbd8c

        SHA1

        394a5817b1b7f82de3ae683e2f98eb07a8a4dcaf

        SHA256

        63a61edd4de5d0ce5a28c1596f0e202ee6edb214b53a3888a70b6aab983aa420

        SHA512

        9f8e82855834e8c3233641bd5855cf7a3bfa53732bb7d045206bbdf5a78c2b92cf2d20db7e3d0dafa67f5aec386786dc3762522cfaa0639894963fbfdcab0393

      • memory/756-1133-0x0000000000750000-0x0000000000782000-memory.dmp

        Filesize

        200KB

      • memory/756-1134-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

        Filesize

        64KB

      • memory/920-168-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-182-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-166-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-165-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-163-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/920-170-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-172-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-174-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-176-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-178-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-180-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-164-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/920-184-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-186-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-188-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-190-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-192-0x00000000026D0000-0x00000000026E2000-memory.dmp

        Filesize

        72KB

      • memory/920-193-0x0000000000400000-0x00000000004BA000-memory.dmp

        Filesize

        744KB

      • memory/920-194-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/920-195-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/920-197-0x0000000000400000-0x00000000004BA000-memory.dmp

        Filesize

        744KB

      • memory/920-161-0x0000000004C00000-0x00000000051A4000-memory.dmp

        Filesize

        5.6MB

      • memory/920-162-0x0000000002860000-0x0000000002870000-memory.dmp

        Filesize

        64KB

      • memory/920-160-0x0000000000660000-0x000000000068D000-memory.dmp

        Filesize

        180KB

      • memory/1096-207-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-209-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-211-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-213-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-215-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-217-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-219-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-221-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-223-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-225-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-227-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-229-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-231-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-233-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-235-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-299-0x00000000021A0000-0x00000000021EB000-memory.dmp

        Filesize

        300KB

      • memory/1096-303-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-300-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-304-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-1112-0x00000000050E0000-0x00000000056F8000-memory.dmp

        Filesize

        6.1MB

      • memory/1096-1113-0x0000000005770000-0x000000000587A000-memory.dmp

        Filesize

        1.0MB

      • memory/1096-1114-0x00000000058B0000-0x00000000058C2000-memory.dmp

        Filesize

        72KB

      • memory/1096-1115-0x00000000058D0000-0x000000000590C000-memory.dmp

        Filesize

        240KB

      • memory/1096-1116-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-1117-0x0000000005BC0000-0x0000000005C26000-memory.dmp

        Filesize

        408KB

      • memory/1096-1118-0x0000000006290000-0x0000000006322000-memory.dmp

        Filesize

        584KB

      • memory/1096-1120-0x0000000006480000-0x0000000006642000-memory.dmp

        Filesize

        1.8MB

      • memory/1096-1121-0x0000000006660000-0x0000000006B8C000-memory.dmp

        Filesize

        5.2MB

      • memory/1096-1122-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-1123-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-1124-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-1126-0x0000000007FA0000-0x0000000008016000-memory.dmp

        Filesize

        472KB

      • memory/1096-1125-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

        Filesize

        64KB

      • memory/1096-205-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-203-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-202-0x00000000050A0000-0x00000000050DE000-memory.dmp

        Filesize

        248KB

      • memory/1096-1127-0x0000000008020000-0x0000000008070000-memory.dmp

        Filesize

        320KB

      • memory/2476-154-0x0000000000A10000-0x0000000000A1A000-memory.dmp

        Filesize

        40KB