Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    83s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 10:20

General

  • Target

    539e77293a4c9fc02114c6f194c9e0af20198b66975a12c61b8d7550536bdb43.exe

  • Size

    874KB

  • MD5

    c239f30fa4d7fddb404481f909d411b6

  • SHA1

    589c8078ae07d99f08c2b1f99009840a48d90a0b

  • SHA256

    539e77293a4c9fc02114c6f194c9e0af20198b66975a12c61b8d7550536bdb43

  • SHA512

    23f709991350fe86dc7481acbbca91e2e138d460b866a63746305a9b21c2ea9094dd7386446a7051392a2edaa9ce54c1b652e7619059ddcbdd89c4c090e3e97d

  • SSDEEP

    24576:EyJjyIsg5YP660BgN38ZoMy0CgMWozhBccgeQhzAm64:TIYSruoIZXUavh

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

rita

C2

193.233.20.28:4125

Attributes
  • auth_value

    5cf1bcf41b0a2f3710619223451dfd3a

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\539e77293a4c9fc02114c6f194c9e0af20198b66975a12c61b8d7550536bdb43.exe
    "C:\Users\Admin\AppData\Local\Temp\539e77293a4c9fc02114c6f194c9e0af20198b66975a12c61b8d7550536bdb43.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6933.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6933.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1888
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6909.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6909.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:452
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3300nj.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3300nj.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1804
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c60mp56.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c60mp56.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4672
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 1080
            5⤵
            • Program crash
            PID:1256
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUzXx92.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUzXx92.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:488
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 488 -s 1356
          4⤵
          • Program crash
          PID:1060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e71eI34.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e71eI34.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3864
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4672 -ip 4672
    1⤵
      PID:3868
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 488 -ip 488
      1⤵
        PID:2300

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e71eI34.exe

        Filesize

        175KB

        MD5

        8b0ea3120d3d291045b26bcea5ccef54

        SHA1

        07ed9587057ae936ca0610051142a4add4f7b6aa

        SHA256

        6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

        SHA512

        6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e71eI34.exe

        Filesize

        175KB

        MD5

        8b0ea3120d3d291045b26bcea5ccef54

        SHA1

        07ed9587057ae936ca0610051142a4add4f7b6aa

        SHA256

        6659717ddb5d87d6dc4e3c9e1d582bc58778c633eb50c61e3bdc57b5d3be7690

        SHA512

        6d112c8621488b8ec6373ec6ab87b20cd07d33ea945d67a6aaa9ca043d9556b735b3c7b9d33c562e29c8e875c3a947a203a33ad27c2d2afe75e2f75873768244

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6933.exe

        Filesize

        729KB

        MD5

        6ab711472e8c0ff9d249d849016b2d73

        SHA1

        c1418e7368902d56d7c21cbed72cf6723e515252

        SHA256

        9499c81b6e201557dbec8fe5c889c6821917da26a9d8566a73f9f9ee90ec7382

        SHA512

        c2ed286b50d5db43f22d2cf364ec18c6bb8c894fb1900255e8252029d4dd3e9e3f772c98ff75032c91194ce8319a1ee77b0b8bfdb667baa8b33698a6cc1245fc

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6933.exe

        Filesize

        729KB

        MD5

        6ab711472e8c0ff9d249d849016b2d73

        SHA1

        c1418e7368902d56d7c21cbed72cf6723e515252

        SHA256

        9499c81b6e201557dbec8fe5c889c6821917da26a9d8566a73f9f9ee90ec7382

        SHA512

        c2ed286b50d5db43f22d2cf364ec18c6bb8c894fb1900255e8252029d4dd3e9e3f772c98ff75032c91194ce8319a1ee77b0b8bfdb667baa8b33698a6cc1245fc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUzXx92.exe

        Filesize

        408KB

        MD5

        389be22dc4ed4ab3b5b8ea2809b3d918

        SHA1

        620bec19d1012e087e7dd58a5e8b6d4a4447007e

        SHA256

        75762f36d9180c0bbc663903e15839dc77bb292484b00c8a78e609dbbfb631b2

        SHA512

        ae6d629e3c28cf15ceeecf27d5d504e2d20545f43804492b3c169923bc291b1337d1ef76dfe2c568a3048acbacf56f04ef318f97638efd4830d801564f6df360

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUzXx92.exe

        Filesize

        408KB

        MD5

        389be22dc4ed4ab3b5b8ea2809b3d918

        SHA1

        620bec19d1012e087e7dd58a5e8b6d4a4447007e

        SHA256

        75762f36d9180c0bbc663903e15839dc77bb292484b00c8a78e609dbbfb631b2

        SHA512

        ae6d629e3c28cf15ceeecf27d5d504e2d20545f43804492b3c169923bc291b1337d1ef76dfe2c568a3048acbacf56f04ef318f97638efd4830d801564f6df360

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6909.exe

        Filesize

        364KB

        MD5

        1ac5519d4b063d2f1e217cff16a77673

        SHA1

        8fb6c1acd0cc6d15b5c707bc5e694026d9215176

        SHA256

        dd2d06e1040ca444b2decd5d77539a4d024dd36b6639b599b6c1c49d2af8b1cc

        SHA512

        a9cacf38d98b69136e69ecd73091cf64c4b9d46ae937649a59e821b447b66af33cc4b4708dfbecd17298deb48ee27a2810c5847bc0e54f3e400f9bd206c671bc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice6909.exe

        Filesize

        364KB

        MD5

        1ac5519d4b063d2f1e217cff16a77673

        SHA1

        8fb6c1acd0cc6d15b5c707bc5e694026d9215176

        SHA256

        dd2d06e1040ca444b2decd5d77539a4d024dd36b6639b599b6c1c49d2af8b1cc

        SHA512

        a9cacf38d98b69136e69ecd73091cf64c4b9d46ae937649a59e821b447b66af33cc4b4708dfbecd17298deb48ee27a2810c5847bc0e54f3e400f9bd206c671bc

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3300nj.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3300nj.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c60mp56.exe

        Filesize

        350KB

        MD5

        524a61984c0ee31b78d28023e04f8e05

        SHA1

        46bd3697882dc118101334509b791f1dd20d857e

        SHA256

        36a3a6cc3c8b0de2665eddcb4d087f28a9dbca48f17d06a1d50195f259f44d1f

        SHA512

        548896be026019a2a41c955a53d3b0df0afdf9faeac6e6d441f3f2065b93664d44b991fd728ea175acd2d60a62b99ce26c9019bbf099000efca02273fdcc389e

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c60mp56.exe

        Filesize

        350KB

        MD5

        524a61984c0ee31b78d28023e04f8e05

        SHA1

        46bd3697882dc118101334509b791f1dd20d857e

        SHA256

        36a3a6cc3c8b0de2665eddcb4d087f28a9dbca48f17d06a1d50195f259f44d1f

        SHA512

        548896be026019a2a41c955a53d3b0df0afdf9faeac6e6d441f3f2065b93664d44b991fd728ea175acd2d60a62b99ce26c9019bbf099000efca02273fdcc389e

      • memory/488-244-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-1116-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-1128-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-1127-0x0000000008EE0000-0x000000000940C000-memory.dmp

        Filesize

        5.2MB

      • memory/488-1126-0x0000000008D10000-0x0000000008ED2000-memory.dmp

        Filesize

        1.8MB

      • memory/488-1125-0x0000000008CA0000-0x0000000008CF0000-memory.dmp

        Filesize

        320KB

      • memory/488-1124-0x0000000008C20000-0x0000000008C96000-memory.dmp

        Filesize

        472KB

      • memory/488-1123-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-1121-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-1122-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-1120-0x0000000008400000-0x0000000008466000-memory.dmp

        Filesize

        408KB

      • memory/488-1119-0x0000000008360000-0x00000000083F2000-memory.dmp

        Filesize

        584KB

      • memory/488-1117-0x0000000008070000-0x00000000080AC000-memory.dmp

        Filesize

        240KB

      • memory/488-1115-0x0000000008050000-0x0000000008062000-memory.dmp

        Filesize

        72KB

      • memory/488-1114-0x0000000007F10000-0x000000000801A000-memory.dmp

        Filesize

        1.0MB

      • memory/488-1113-0x0000000007880000-0x0000000007E98000-memory.dmp

        Filesize

        6.1MB

      • memory/488-240-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-242-0x0000000004B80000-0x0000000004B90000-memory.dmp

        Filesize

        64KB

      • memory/488-238-0x00000000047C0000-0x000000000480B000-memory.dmp

        Filesize

        300KB

      • memory/488-236-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-234-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-232-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-230-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-228-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-203-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-204-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-206-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-208-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-210-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-212-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-214-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-216-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-218-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-220-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-222-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-224-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/488-226-0x0000000007700000-0x000000000773E000-memory.dmp

        Filesize

        248KB

      • memory/1804-154-0x0000000000790000-0x000000000079A000-memory.dmp

        Filesize

        40KB

      • memory/3864-1135-0x00000000053E0000-0x00000000053F0000-memory.dmp

        Filesize

        64KB

      • memory/3864-1134-0x0000000000810000-0x0000000000842000-memory.dmp

        Filesize

        200KB

      • memory/4672-182-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-178-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-195-0x0000000004A00000-0x0000000004A10000-memory.dmp

        Filesize

        64KB

      • memory/4672-193-0x0000000000400000-0x0000000002B1B000-memory.dmp

        Filesize

        39.1MB

      • memory/4672-192-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-163-0x0000000004A00000-0x0000000004A10000-memory.dmp

        Filesize

        64KB

      • memory/4672-188-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-190-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-186-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-164-0x0000000007240000-0x00000000077E4000-memory.dmp

        Filesize

        5.6MB

      • memory/4672-184-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-162-0x0000000004A00000-0x0000000004A10000-memory.dmp

        Filesize

        64KB

      • memory/4672-180-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-194-0x0000000004A00000-0x0000000004A10000-memory.dmp

        Filesize

        64KB

      • memory/4672-176-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-174-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-172-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-170-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-168-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-166-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-165-0x0000000004A20000-0x0000000004A32000-memory.dmp

        Filesize

        72KB

      • memory/4672-160-0x0000000002C90000-0x0000000002CBD000-memory.dmp

        Filesize

        180KB

      • memory/4672-196-0x0000000004A00000-0x0000000004A10000-memory.dmp

        Filesize

        64KB

      • memory/4672-198-0x0000000000400000-0x0000000002B1B000-memory.dmp

        Filesize

        39.1MB

      • memory/4672-161-0x0000000004A00000-0x0000000004A10000-memory.dmp

        Filesize

        64KB