Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2023, 20:05
Static task
static1
Behavioral task
behavioral1
Sample
0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe
Resource
win10v2004-20230220-en
General
-
Target
0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe
-
Size
786KB
-
MD5
edc42044ab0ca79f2b7e7f4d9c6392e5
-
SHA1
40dfd32d74c1c597c91895c6fcf5e87b06804bcc
-
SHA256
0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f
-
SHA512
751590d25daf9472fd0cef3535caeb5b7c4071d211a9f62a082ef9c4ffd72a6055ffe76355e7c57000b98bd227e7bd04f02d82e454b3543b30030cad15f900d4
-
SSDEEP
24576:XyKeCXWnSfHrLyFiw5vrzVUQpqjypB9S:iRCGCK5DzV3qjC
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
rita
193.233.20.28:4125
-
auth_value
5cf1bcf41b0a2f3710619223451dfd3a
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" c43Go35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" c43Go35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b5637RP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b5637RP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b5637RP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b5637RP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" c43Go35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" c43Go35.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b5637RP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b5637RP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection c43Go35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" c43Go35.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
resource yara_rule behavioral1/memory/1096-202-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-203-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-205-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-207-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-209-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-211-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-213-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-215-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-217-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-219-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-221-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-223-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-225-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-227-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-229-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-231-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-233-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-235-0x00000000050A0000-0x00000000050DE000-memory.dmp family_redline behavioral1/memory/1096-300-0x0000000004AE0000-0x0000000004AF0000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
pid Process 2636 tice9081.exe 2964 tice8644.exe 2476 b5637RP.exe 920 c43Go35.exe 1096 dNOOY32.exe 756 e62gp44.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b5637RP.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features c43Go35.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" c43Go35.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" tice8644.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tice9081.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" tice9081.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tice8644.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
pid pid_target Process procid_target 4652 920 WerFault.exe 87 3268 1096 WerFault.exe 90 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2476 b5637RP.exe 2476 b5637RP.exe 920 c43Go35.exe 920 c43Go35.exe 1096 dNOOY32.exe 1096 dNOOY32.exe 756 e62gp44.exe 756 e62gp44.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2476 b5637RP.exe Token: SeDebugPrivilege 920 c43Go35.exe Token: SeDebugPrivilege 1096 dNOOY32.exe Token: SeDebugPrivilege 756 e62gp44.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 624 wrote to memory of 2636 624 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe 84 PID 624 wrote to memory of 2636 624 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe 84 PID 624 wrote to memory of 2636 624 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe 84 PID 2636 wrote to memory of 2964 2636 tice9081.exe 85 PID 2636 wrote to memory of 2964 2636 tice9081.exe 85 PID 2636 wrote to memory of 2964 2636 tice9081.exe 85 PID 2964 wrote to memory of 2476 2964 tice8644.exe 86 PID 2964 wrote to memory of 2476 2964 tice8644.exe 86 PID 2964 wrote to memory of 920 2964 tice8644.exe 87 PID 2964 wrote to memory of 920 2964 tice8644.exe 87 PID 2964 wrote to memory of 920 2964 tice8644.exe 87 PID 2636 wrote to memory of 1096 2636 tice9081.exe 90 PID 2636 wrote to memory of 1096 2636 tice9081.exe 90 PID 2636 wrote to memory of 1096 2636 tice9081.exe 90 PID 624 wrote to memory of 756 624 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe 94 PID 624 wrote to memory of 756 624 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe 94 PID 624 wrote to memory of 756 624 0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe"C:\Users\Admin\AppData\Local\Temp\0518a762594bce7869cfd33523f111f16944f34198375384dab56d3a04e6342f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice9081.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice9081.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8644.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8644.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5637RP.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5637RP.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c43Go35.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c43Go35.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 10845⤵
- Program crash
PID:4652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dNOOY32.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dNOOY32.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 16884⤵
- Program crash
PID:3268
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e62gp44.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e62gp44.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 920 -ip 9201⤵PID:1652
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1096 -ip 10961⤵PID:2056
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD58b0ea3120d3d291045b26bcea5ccef54
SHA107ed9587057ae936ca0610051142a4add4f7b6aa
SHA2566659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690
SHA5126d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244
-
Filesize
175KB
MD58b0ea3120d3d291045b26bcea5ccef54
SHA107ed9587057ae936ca0610051142a4add4f7b6aa
SHA2566659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690
SHA5126d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244
-
Filesize
641KB
MD5781477be5ea4eac778260ffa33d5ec78
SHA12a9c60da657164a657b8dd3891fc17d95b497f0f
SHA25653566cda176900dd4fd349a061655112fc7eae46ab03d402f1f40cf0bb891fb2
SHA5129507e720c429d1f859ee8aa7f6f00b2c0a3d551a3bde1b951f773fd1e1901573010edc8fcfd9bc4cf921ba6929a17590f10184c77b7db95efc694e0e26753a37
-
Filesize
641KB
MD5781477be5ea4eac778260ffa33d5ec78
SHA12a9c60da657164a657b8dd3891fc17d95b497f0f
SHA25653566cda176900dd4fd349a061655112fc7eae46ab03d402f1f40cf0bb891fb2
SHA5129507e720c429d1f859ee8aa7f6f00b2c0a3d551a3bde1b951f773fd1e1901573010edc8fcfd9bc4cf921ba6929a17590f10184c77b7db95efc694e0e26753a37
-
Filesize
294KB
MD5cfca2843f22872eba40ba48206f6d93b
SHA17aeea0e3c73cd4cd4f7590bdcd0c5cc864d92951
SHA25613f8235abe83aacb0b63626158668a343cd79f4f0d595b7dcf8af1111316ddee
SHA512e741b91329158cff484f42912a0b42f85b064d0997bff87a42bb05d7a80e404ecd980b8a3c8a510a7bbc51f71df6e3db57cff90ddef53fb7cfe6735049e3c324
-
Filesize
294KB
MD5cfca2843f22872eba40ba48206f6d93b
SHA17aeea0e3c73cd4cd4f7590bdcd0c5cc864d92951
SHA25613f8235abe83aacb0b63626158668a343cd79f4f0d595b7dcf8af1111316ddee
SHA512e741b91329158cff484f42912a0b42f85b064d0997bff87a42bb05d7a80e404ecd980b8a3c8a510a7bbc51f71df6e3db57cff90ddef53fb7cfe6735049e3c324
-
Filesize
321KB
MD5dc5d4ca4890bba6045a1611889b765f8
SHA1510b5e87803fc2ff39fa3ef2349d4bc04f037b27
SHA25681a38c0a0fb05df8502d887fec243eb548ca82b850b34d8d9d0887bdf5fe43da
SHA51236fb046b6e9c848d0140bc8b2c86824a81cd9c81b0206625f1eb0d6e7501f6733721cc562fcf422a2391496d21fe36fb70871cbc7d6f3a6d05154f3e8ec88358
-
Filesize
321KB
MD5dc5d4ca4890bba6045a1611889b765f8
SHA1510b5e87803fc2ff39fa3ef2349d4bc04f037b27
SHA25681a38c0a0fb05df8502d887fec243eb548ca82b850b34d8d9d0887bdf5fe43da
SHA51236fb046b6e9c848d0140bc8b2c86824a81cd9c81b0206625f1eb0d6e7501f6733721cc562fcf422a2391496d21fe36fb70871cbc7d6f3a6d05154f3e8ec88358
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
237KB
MD5199301397975c341a703a697654fbd8c
SHA1394a5817b1b7f82de3ae683e2f98eb07a8a4dcaf
SHA25663a61edd4de5d0ce5a28c1596f0e202ee6edb214b53a3888a70b6aab983aa420
SHA5129f8e82855834e8c3233641bd5855cf7a3bfa53732bb7d045206bbdf5a78c2b92cf2d20db7e3d0dafa67f5aec386786dc3762522cfaa0639894963fbfdcab0393
-
Filesize
237KB
MD5199301397975c341a703a697654fbd8c
SHA1394a5817b1b7f82de3ae683e2f98eb07a8a4dcaf
SHA25663a61edd4de5d0ce5a28c1596f0e202ee6edb214b53a3888a70b6aab983aa420
SHA5129f8e82855834e8c3233641bd5855cf7a3bfa53732bb7d045206bbdf5a78c2b92cf2d20db7e3d0dafa67f5aec386786dc3762522cfaa0639894963fbfdcab0393