Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • max time network
    63s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/03/2023, 09:42

General

  • Target

    bca13b2c82150434f079278f2eb90054625c5271f6056710de1fbd031bf6bb84.exe

  • Size

    875KB

  • MD5

    6d62ea84592417f19a7b6e7fd76e4833

  • SHA1

    18ed26fb8621d4c9e08775bd989beed77c7a6145

  • SHA256

    bca13b2c82150434f079278f2eb90054625c5271f6056710de1fbd031bf6bb84

  • SHA512

    ade02194816a0efcfd1b209c54ab68b2d7fbbe2f0d5474f98c897c644cdb5fdacb804509d3d40c0347ad3b1a54ff821c5d1228dae711eb5200eb88ea25cd126e

  • SSDEEP

    24576:Cyme7XJq9CTiKrBIuKpUK2IxJuvI1IfE3hucO47YX1:pm4Xk8nBmUmxJujcNO9

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rita

C2

193.233.20.28:4125

Attributes
  • auth_value

    5cf1bcf41b0a2f3710619223451dfd3a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bca13b2c82150434f079278f2eb90054625c5271f6056710de1fbd031bf6bb84.exe
    "C:\Users\Admin\AppData\Local\Temp\bca13b2c82150434f079278f2eb90054625c5271f6056710de1fbd031bf6bb84.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice0709.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice0709.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0587.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0587.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2951DU.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2951DU.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3972
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c68oJ66.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c68oJ66.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1660
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtsAS36.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtsAS36.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e54YR26.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e54YR26.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e54YR26.exe

    Filesize

    175KB

    MD5

    8b0ea3120d3d291045b26bcea5ccef54

    SHA1

    07ed9587057ae936ca0610051142a4add4f7b6aa

    SHA256

    6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

    SHA512

    6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e54YR26.exe

    Filesize

    175KB

    MD5

    8b0ea3120d3d291045b26bcea5ccef54

    SHA1

    07ed9587057ae936ca0610051142a4add4f7b6aa

    SHA256

    6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

    SHA512

    6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice0709.exe

    Filesize

    730KB

    MD5

    e05f3a1deab5da5745d241c74e317087

    SHA1

    d0c33a708b11131b56c1769c2dee889824ace4ab

    SHA256

    aac681137f5da0d681f6b3ec3ee9f1836893810213164427d938d69b33b49bce

    SHA512

    bd6c8373f7f91a87704a9a9c76f7d6eef72f8ba2b0a4348ce52c1478afed986a9e80c8fc06e9ff0af702639ff21079525863bb3181eec562e6a54f10df606928

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice0709.exe

    Filesize

    730KB

    MD5

    e05f3a1deab5da5745d241c74e317087

    SHA1

    d0c33a708b11131b56c1769c2dee889824ace4ab

    SHA256

    aac681137f5da0d681f6b3ec3ee9f1836893810213164427d938d69b33b49bce

    SHA512

    bd6c8373f7f91a87704a9a9c76f7d6eef72f8ba2b0a4348ce52c1478afed986a9e80c8fc06e9ff0af702639ff21079525863bb3181eec562e6a54f10df606928

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtsAS36.exe

    Filesize

    408KB

    MD5

    e21d4d7fa3a2dacbf05843b7eaa7ad8a

    SHA1

    dc487b9be33f3a6a48efc9027dc3abd04b40e356

    SHA256

    c3c96c212708c88961289cd56c1271e93c38e6f5d800aed2d92e81c08d5b165b

    SHA512

    85f6b1b99507d40ebff0aea896d637cc725bda8f962955b7e3093454959be04dc298ccf2998c9b47897140a72b4b374cf99ba6a09ffa8c0f2e0036a3ba43d8a8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dtsAS36.exe

    Filesize

    408KB

    MD5

    e21d4d7fa3a2dacbf05843b7eaa7ad8a

    SHA1

    dc487b9be33f3a6a48efc9027dc3abd04b40e356

    SHA256

    c3c96c212708c88961289cd56c1271e93c38e6f5d800aed2d92e81c08d5b165b

    SHA512

    85f6b1b99507d40ebff0aea896d637cc725bda8f962955b7e3093454959be04dc298ccf2998c9b47897140a72b4b374cf99ba6a09ffa8c0f2e0036a3ba43d8a8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0587.exe

    Filesize

    364KB

    MD5

    4859c9633d21af6fed8a45d5845f7cdf

    SHA1

    36acf5ee5174619276071e1371b2b2eb78b20471

    SHA256

    176b134876cdf70e116197349f4b234c6d20e7b61feb384d4625d1ee37250147

    SHA512

    232229044ea670c0ea86fdf0f3fdb718d456e9685a48843e446d6829a379eb6733f97ef8ed37e560b57f3bd2f509784a48fed09da26486fb3d91c54bd7e341cf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice0587.exe

    Filesize

    364KB

    MD5

    4859c9633d21af6fed8a45d5845f7cdf

    SHA1

    36acf5ee5174619276071e1371b2b2eb78b20471

    SHA256

    176b134876cdf70e116197349f4b234c6d20e7b61feb384d4625d1ee37250147

    SHA512

    232229044ea670c0ea86fdf0f3fdb718d456e9685a48843e446d6829a379eb6733f97ef8ed37e560b57f3bd2f509784a48fed09da26486fb3d91c54bd7e341cf

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2951DU.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b2951DU.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c68oJ66.exe

    Filesize

    350KB

    MD5

    62b5fc3d100412f30e67b4dfd359b07b

    SHA1

    4048fd68470fa5b2f5451e4b058773defacc124d

    SHA256

    2ee59ec2a73fc837206e8eb3a742f9111994b7b17e068662f402aa16397beafa

    SHA512

    a296e9000319e60f9848939fe379bdf56101a3f288fb6d910704a6913fdeaba1996c95914ef0334fced1f7ba1250b19c137f7d87f094bf9032547b1475f993c6

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c68oJ66.exe

    Filesize

    350KB

    MD5

    62b5fc3d100412f30e67b4dfd359b07b

    SHA1

    4048fd68470fa5b2f5451e4b058773defacc124d

    SHA256

    2ee59ec2a73fc837206e8eb3a742f9111994b7b17e068662f402aa16397beafa

    SHA512

    a296e9000319e60f9848939fe379bdf56101a3f288fb6d910704a6913fdeaba1996c95914ef0334fced1f7ba1250b19c137f7d87f094bf9032547b1475f993c6

  • memory/1660-148-0x0000000004990000-0x00000000049AA000-memory.dmp

    Filesize

    104KB

  • memory/1660-149-0x0000000007090000-0x000000000758E000-memory.dmp

    Filesize

    5.0MB

  • memory/1660-150-0x0000000004B70000-0x0000000004B88000-memory.dmp

    Filesize

    96KB

  • memory/1660-151-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/1660-153-0x00000000049B0000-0x00000000049C0000-memory.dmp

    Filesize

    64KB

  • memory/1660-152-0x00000000049B0000-0x00000000049C0000-memory.dmp

    Filesize

    64KB

  • memory/1660-154-0x00000000049B0000-0x00000000049C0000-memory.dmp

    Filesize

    64KB

  • memory/1660-155-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-158-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-160-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-156-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-164-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-168-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-170-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-166-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-162-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-172-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-176-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-178-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-174-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-180-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-182-0x0000000004B70000-0x0000000004B82000-memory.dmp

    Filesize

    72KB

  • memory/1660-183-0x0000000000400000-0x0000000002B1B000-memory.dmp

    Filesize

    39.1MB

  • memory/1660-186-0x00000000049B0000-0x00000000049C0000-memory.dmp

    Filesize

    64KB

  • memory/1660-185-0x0000000000400000-0x0000000002B1B000-memory.dmp

    Filesize

    39.1MB

  • memory/2216-192-0x0000000004C60000-0x0000000004CA4000-memory.dmp

    Filesize

    272KB

  • memory/2216-224-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-196-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-198-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-200-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-194-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-204-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-202-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-206-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-193-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-208-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-210-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-212-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-216-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-214-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-218-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-220-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-222-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-226-0x0000000004C60000-0x0000000004C9E000-memory.dmp

    Filesize

    248KB

  • memory/2216-231-0x0000000007250000-0x0000000007260000-memory.dmp

    Filesize

    64KB

  • memory/2216-230-0x0000000002C80000-0x0000000002CCB000-memory.dmp

    Filesize

    300KB

  • memory/2216-191-0x0000000004BE0000-0x0000000004C26000-memory.dmp

    Filesize

    280KB

  • memory/2216-1101-0x0000000007D70000-0x0000000008376000-memory.dmp

    Filesize

    6.0MB

  • memory/2216-1102-0x0000000007760000-0x000000000786A000-memory.dmp

    Filesize

    1.0MB

  • memory/2216-1103-0x00000000071E0000-0x00000000071F2000-memory.dmp

    Filesize

    72KB

  • memory/2216-1104-0x0000000007200000-0x000000000723E000-memory.dmp

    Filesize

    248KB

  • memory/2216-1105-0x0000000007970000-0x00000000079BB000-memory.dmp

    Filesize

    300KB

  • memory/2216-1106-0x0000000007250000-0x0000000007260000-memory.dmp

    Filesize

    64KB

  • memory/2216-1108-0x0000000007250000-0x0000000007260000-memory.dmp

    Filesize

    64KB

  • memory/2216-1109-0x0000000007250000-0x0000000007260000-memory.dmp

    Filesize

    64KB

  • memory/2216-1110-0x0000000007B00000-0x0000000007B66000-memory.dmp

    Filesize

    408KB

  • memory/2216-1111-0x00000000087D0000-0x0000000008862000-memory.dmp

    Filesize

    584KB

  • memory/2216-1112-0x00000000089B0000-0x0000000008B72000-memory.dmp

    Filesize

    1.8MB

  • memory/2216-1113-0x0000000008BA0000-0x00000000090CC000-memory.dmp

    Filesize

    5.2MB

  • memory/2216-1114-0x0000000009210000-0x0000000009286000-memory.dmp

    Filesize

    472KB

  • memory/2216-1115-0x0000000009290000-0x00000000092E0000-memory.dmp

    Filesize

    320KB

  • memory/2216-1116-0x0000000007250000-0x0000000007260000-memory.dmp

    Filesize

    64KB

  • memory/3972-142-0x0000000000710000-0x000000000071A000-memory.dmp

    Filesize

    40KB

  • memory/4492-1122-0x0000000000690000-0x00000000006C2000-memory.dmp

    Filesize

    200KB

  • memory/4492-1123-0x0000000005000000-0x0000000005010000-memory.dmp

    Filesize

    64KB

  • memory/4492-1124-0x0000000004F90000-0x0000000004FDB000-memory.dmp

    Filesize

    300KB