Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    108s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 05:52

General

  • Target

    19a2b5206d6f14bc9afb567e60280f48868162e86f7648178354206ddcdc1c0e.exe

  • Size

    876KB

  • MD5

    8f0be4a12412e6edf65769c7f4f53ff8

  • SHA1

    26d4ddaafbd3baf4bfee2dd14610bd677073e93f

  • SHA256

    19a2b5206d6f14bc9afb567e60280f48868162e86f7648178354206ddcdc1c0e

  • SHA512

    42faf7688abd85aaef2c7a081b1d1d4d76cb1e554ddcdf0b973192e834ee90fb14c802a4849ca45846b6f97572ae509fc046747f91b34d2e75ef8da8571242ef

  • SSDEEP

    12288:tMr5y90pZW7vjIlELjsHFHGfVW8SubBxr3DfSzPdF2PahGSzxbjDHpzt6wAhv:gyyxlELI48ubBZzEPd0PPS1J5E

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rita

C2

193.233.20.28:4125

Attributes
  • auth_value

    5cf1bcf41b0a2f3710619223451dfd3a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\19a2b5206d6f14bc9afb567e60280f48868162e86f7648178354206ddcdc1c0e.exe
    "C:\Users\Admin\AppData\Local\Temp\19a2b5206d6f14bc9afb567e60280f48868162e86f7648178354206ddcdc1c0e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3314.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3314.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0781.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0781.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:244
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5190iQ.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5190iQ.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1936
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c13Cj92.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c13Cj92.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2584
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 1084
            5⤵
            • Program crash
            PID:4864
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEcIv03.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEcIv03.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3956
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 1336
          4⤵
          • Program crash
          PID:4032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e42Dx86.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e42Dx86.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:220
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2584 -ip 2584
    1⤵
      PID:1232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3956 -ip 3956
      1⤵
        PID:3272

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e42Dx86.exe

        Filesize

        175KB

        MD5

        8b0ea3120d3d291045b26bcea5ccef54

        SHA1

        07ed9587057ae936ca0610051142a4add4f7b6aa

        SHA256

        6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

        SHA512

        6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e42Dx86.exe

        Filesize

        175KB

        MD5

        8b0ea3120d3d291045b26bcea5ccef54

        SHA1

        07ed9587057ae936ca0610051142a4add4f7b6aa

        SHA256

        6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

        SHA512

        6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3314.exe

        Filesize

        731KB

        MD5

        ebe2ce8ca5a60777c3014101a34c718f

        SHA1

        bfda1e2a8fa30d0621187a31756c13ce6d44d1bf

        SHA256

        2c0fa10677ef393d4bb3063de42593341187854408a03fad5e05134114e30665

        SHA512

        9537eb70d68e1d6940a8ce42b386c05ac2689df48f1a2f54d8cced8a360907fd275dc59daa4fd26e7fa692ca6ccf08fbe41a29eae1823015d18b663d72b44a13

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice3314.exe

        Filesize

        731KB

        MD5

        ebe2ce8ca5a60777c3014101a34c718f

        SHA1

        bfda1e2a8fa30d0621187a31756c13ce6d44d1bf

        SHA256

        2c0fa10677ef393d4bb3063de42593341187854408a03fad5e05134114e30665

        SHA512

        9537eb70d68e1d6940a8ce42b386c05ac2689df48f1a2f54d8cced8a360907fd275dc59daa4fd26e7fa692ca6ccf08fbe41a29eae1823015d18b663d72b44a13

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEcIv03.exe

        Filesize

        409KB

        MD5

        9962d3bc434bcb2af89b22dce2a77dec

        SHA1

        6ab0e937a4a2b0938ebd6748e324244f8cc8e704

        SHA256

        1375c0782594e5276340504d9939c738f6256c9b3ec8cbcc4cd6e3b50a0665bf

        SHA512

        481aaa70ba734e97b16bbeb234f8664f3f51a1f23a06a3e05d668f33957d6abda2d57fb24416c6828095d490f1eb97fab03a0f9fed43bd21e54a476e4d06d936

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dEcIv03.exe

        Filesize

        409KB

        MD5

        9962d3bc434bcb2af89b22dce2a77dec

        SHA1

        6ab0e937a4a2b0938ebd6748e324244f8cc8e704

        SHA256

        1375c0782594e5276340504d9939c738f6256c9b3ec8cbcc4cd6e3b50a0665bf

        SHA512

        481aaa70ba734e97b16bbeb234f8664f3f51a1f23a06a3e05d668f33957d6abda2d57fb24416c6828095d490f1eb97fab03a0f9fed43bd21e54a476e4d06d936

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0781.exe

        Filesize

        366KB

        MD5

        a19034aa5bc3f394e2b16c2fb887fceb

        SHA1

        ee120463365fabcc01f46234fabc81dd813e9cd6

        SHA256

        5785fc51607264efc37a6d1fd63a86c8a4396af9c825d4ff666aa56b9391bf02

        SHA512

        904fa94725f2a1dd98a869fef6125a692348902754c38ec81754eebb1cd2a7b95607cfd0d7a12ca423f701a96231c5e4247f53a2fb394b14f92f70da5f5d2cba

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0781.exe

        Filesize

        366KB

        MD5

        a19034aa5bc3f394e2b16c2fb887fceb

        SHA1

        ee120463365fabcc01f46234fabc81dd813e9cd6

        SHA256

        5785fc51607264efc37a6d1fd63a86c8a4396af9c825d4ff666aa56b9391bf02

        SHA512

        904fa94725f2a1dd98a869fef6125a692348902754c38ec81754eebb1cd2a7b95607cfd0d7a12ca423f701a96231c5e4247f53a2fb394b14f92f70da5f5d2cba

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5190iQ.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b5190iQ.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c13Cj92.exe

        Filesize

        351KB

        MD5

        fd43259b07f5156f4cc266b5ba0fc63f

        SHA1

        da4ebd94a6ac2faf6d8cbdd696ecee6828b0b436

        SHA256

        36e65629dbe427f1995332c4f91fb0ce3f2b62991b1ab800cfe3e485af97cf72

        SHA512

        0dd0d3f4019ec1d18e525cbd1460036485a29ca3068ca096956d1637612aae70e50bbe9d80f2068fb23e08052e0715f0f85de8ccd4055a9979a193beabfa4a34

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c13Cj92.exe

        Filesize

        351KB

        MD5

        fd43259b07f5156f4cc266b5ba0fc63f

        SHA1

        da4ebd94a6ac2faf6d8cbdd696ecee6828b0b436

        SHA256

        36e65629dbe427f1995332c4f91fb0ce3f2b62991b1ab800cfe3e485af97cf72

        SHA512

        0dd0d3f4019ec1d18e525cbd1460036485a29ca3068ca096956d1637612aae70e50bbe9d80f2068fb23e08052e0715f0f85de8ccd4055a9979a193beabfa4a34

      • memory/220-1133-0x0000000000240000-0x0000000000272000-memory.dmp

        Filesize

        200KB

      • memory/220-1134-0x0000000004DF0000-0x0000000004E00000-memory.dmp

        Filesize

        64KB

      • memory/1936-154-0x0000000000230000-0x000000000023A000-memory.dmp

        Filesize

        40KB

      • memory/2584-165-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-187-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-167-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-163-0x00000000071D0000-0x0000000007774000-memory.dmp

        Filesize

        5.6MB

      • memory/2584-169-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-171-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-173-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-177-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-175-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-181-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-179-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-164-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-185-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-191-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-189-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-183-0x0000000004AF0000-0x0000000004B02000-memory.dmp

        Filesize

        72KB

      • memory/2584-192-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/2584-193-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/2584-194-0x0000000000400000-0x0000000002B1C000-memory.dmp

        Filesize

        39.1MB

      • memory/2584-196-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/2584-197-0x0000000000400000-0x0000000002B1C000-memory.dmp

        Filesize

        39.1MB

      • memory/2584-162-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/2584-161-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/2584-160-0x0000000004770000-0x000000000479D000-memory.dmp

        Filesize

        180KB

      • memory/3956-205-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-209-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-211-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-213-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-215-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-217-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-219-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-221-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-223-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-225-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-229-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-227-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-231-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-233-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-235-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-241-0x0000000002CA0000-0x0000000002CEB000-memory.dmp

        Filesize

        300KB

      • memory/3956-243-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-245-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-247-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-1112-0x0000000007730000-0x0000000007D48000-memory.dmp

        Filesize

        6.1MB

      • memory/3956-1113-0x0000000007DD0000-0x0000000007EDA000-memory.dmp

        Filesize

        1.0MB

      • memory/3956-1114-0x0000000007F10000-0x0000000007F22000-memory.dmp

        Filesize

        72KB

      • memory/3956-1115-0x0000000007F30000-0x0000000007F6C000-memory.dmp

        Filesize

        240KB

      • memory/3956-1116-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-1118-0x0000000008220000-0x00000000082B2000-memory.dmp

        Filesize

        584KB

      • memory/3956-1119-0x00000000082C0000-0x0000000008326000-memory.dmp

        Filesize

        408KB

      • memory/3956-1120-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-1121-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-1122-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB

      • memory/3956-1123-0x00000000089C0000-0x0000000008A36000-memory.dmp

        Filesize

        472KB

      • memory/3956-1124-0x0000000008A50000-0x0000000008AA0000-memory.dmp

        Filesize

        320KB

      • memory/3956-1125-0x0000000009FC0000-0x000000000A182000-memory.dmp

        Filesize

        1.8MB

      • memory/3956-1126-0x000000000A190000-0x000000000A6BC000-memory.dmp

        Filesize

        5.2MB

      • memory/3956-207-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-202-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-203-0x00000000076E0000-0x000000000771E000-memory.dmp

        Filesize

        248KB

      • memory/3956-1127-0x00000000070E0000-0x00000000070F0000-memory.dmp

        Filesize

        64KB