Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    59s
  • max time network
    61s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/03/2023, 20:18

General

  • Target

    6226c1211403cf11636ae7c37524879c0695f3cf9dbc523c13413f4763cb6f20.exe

  • Size

    864KB

  • MD5

    6a7079138184b175d99864c9a200c8be

  • SHA1

    45db38541f22f3af9c34d7361a431881f27906e2

  • SHA256

    6226c1211403cf11636ae7c37524879c0695f3cf9dbc523c13413f4763cb6f20

  • SHA512

    78cab2f5b172144dbf13fc4e576476e41240734f8cddd3a071442993807d1b0cf17c10690133cf6e804746b609c1dbc178df503f6e05543b9ebddfc3d01479e2

  • SSDEEP

    24576:NyLpDdERiLtVEhmy8VkhIJPYGKS2J682JQ:oLX2iLIhGHKSw6dJ

Malware Config

Extracted

Family

redline

Botnet

mango

C2

193.233.20.28:4125

Attributes
  • auth_value

    ecf79d7f5227d998a3501c972d915d23

Extracted

Family

redline

Botnet

sito

C2

193.233.20.28:4125

Attributes
  • auth_value

    030f94d8e396dbe51ce339b815cdad17

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6226c1211403cf11636ae7c37524879c0695f3cf9dbc523c13413f4763cb6f20.exe
    "C:\Users\Admin\AppData\Local\Temp\6226c1211403cf11636ae7c37524879c0695f3cf9dbc523c13413f4763cb6f20.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2444
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6447.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6447.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8942.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8942.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3060
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7633Vb.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7633Vb.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4540
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c15eV22.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c15eV22.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:8
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dJaBY04.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dJaBY04.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e83wa09.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e83wa09.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4124

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e83wa09.exe

    Filesize

    175KB

    MD5

    795f3fe5687db9b19853eaf6acdc389a

    SHA1

    cd1ba862909c58a01d3a8e44c29cb71bb6b50630

    SHA256

    448bad37914cb6f2102c2c8b10cd93770e529ab4fd13e616ee99e2e184cb0e56

    SHA512

    d9fdfef28242f378cda4698e6e89ae736dc60f5e1852aa414519bf0bdfce129e6c015306c43c7f10ab7648d158761ebaeb4dd54c1a04fa6d20a2f35cbf2b6130

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e83wa09.exe

    Filesize

    175KB

    MD5

    795f3fe5687db9b19853eaf6acdc389a

    SHA1

    cd1ba862909c58a01d3a8e44c29cb71bb6b50630

    SHA256

    448bad37914cb6f2102c2c8b10cd93770e529ab4fd13e616ee99e2e184cb0e56

    SHA512

    d9fdfef28242f378cda4698e6e89ae736dc60f5e1852aa414519bf0bdfce129e6c015306c43c7f10ab7648d158761ebaeb4dd54c1a04fa6d20a2f35cbf2b6130

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6447.exe

    Filesize

    719KB

    MD5

    772ae3fbdbfa806853dfc8af921dc521

    SHA1

    eb7af2d00d2c3f5f25535c7be62ca400c32d3740

    SHA256

    82b00e6e000e84bfe41a3be942b58ad6b4ae544612b7f724946b344950fa6eac

    SHA512

    99a1ef20079aa84b77eddf3730835c202bcfd501f0585daaae433105134d420b3aab62e36e67b34e0253c80c8d6582693e91113f0e6428c7c2cf8a7e9503903e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice6447.exe

    Filesize

    719KB

    MD5

    772ae3fbdbfa806853dfc8af921dc521

    SHA1

    eb7af2d00d2c3f5f25535c7be62ca400c32d3740

    SHA256

    82b00e6e000e84bfe41a3be942b58ad6b4ae544612b7f724946b344950fa6eac

    SHA512

    99a1ef20079aa84b77eddf3730835c202bcfd501f0585daaae433105134d420b3aab62e36e67b34e0253c80c8d6582693e91113f0e6428c7c2cf8a7e9503903e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dJaBY04.exe

    Filesize

    401KB

    MD5

    fdd21762a328ff98e5939da9a8f496ee

    SHA1

    c94ceb01edd61859c81af6bf73e8b5f3b7e9e9a6

    SHA256

    71b4baa1b9c216d1bc707616e9fd19d884c86c47e0adde8f931faadf01ff7d0d

    SHA512

    090028a074f308c9bd12c71a961ececf4b5b1ad2524b7faca818bbb3789d911842a6f6861f28d39b8515b1d88bbc5060c09d3a47ef594278ab6ed8e89a28e420

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dJaBY04.exe

    Filesize

    401KB

    MD5

    fdd21762a328ff98e5939da9a8f496ee

    SHA1

    c94ceb01edd61859c81af6bf73e8b5f3b7e9e9a6

    SHA256

    71b4baa1b9c216d1bc707616e9fd19d884c86c47e0adde8f931faadf01ff7d0d

    SHA512

    090028a074f308c9bd12c71a961ececf4b5b1ad2524b7faca818bbb3789d911842a6f6861f28d39b8515b1d88bbc5060c09d3a47ef594278ab6ed8e89a28e420

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8942.exe

    Filesize

    360KB

    MD5

    7f9d099743134cb3f283a9966be27ce2

    SHA1

    59eb40e8df9bf8fc54d8d71a8029b32d92c346cb

    SHA256

    9a1c631815ed76f87e3d2ad0bf08ee84fb207b0ef1ce65355d142f05c0ca77fd

    SHA512

    7e93ace3e40b4ba89f5eaac0ee52b7cc8fa98db11808cc8949e68f9e1cdbffd6324410d10b03045f98f5c413b18962fc0178d702db4734af02d5e5459be3dea8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8942.exe

    Filesize

    360KB

    MD5

    7f9d099743134cb3f283a9966be27ce2

    SHA1

    59eb40e8df9bf8fc54d8d71a8029b32d92c346cb

    SHA256

    9a1c631815ed76f87e3d2ad0bf08ee84fb207b0ef1ce65355d142f05c0ca77fd

    SHA512

    7e93ace3e40b4ba89f5eaac0ee52b7cc8fa98db11808cc8949e68f9e1cdbffd6324410d10b03045f98f5c413b18962fc0178d702db4734af02d5e5459be3dea8

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7633Vb.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b7633Vb.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c15eV22.exe

    Filesize

    343KB

    MD5

    71044743fa9b10ae9a037895c6751907

    SHA1

    1f92ec6db5d5363c85aaa08842be657804bbf825

    SHA256

    0a201e22f3197b79e60abb326784c6f3644503edf9bfc5e4630e126d30f1cdf7

    SHA512

    3dfea867675e40aae8d631303449d8102982ea5cb92a29e51aeebe24d40c4ffe58814fa49da08fef5eb5a91217da977f45e25b8fd8b3a31824e408510d644712

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c15eV22.exe

    Filesize

    343KB

    MD5

    71044743fa9b10ae9a037895c6751907

    SHA1

    1f92ec6db5d5363c85aaa08842be657804bbf825

    SHA256

    0a201e22f3197b79e60abb326784c6f3644503edf9bfc5e4630e126d30f1cdf7

    SHA512

    3dfea867675e40aae8d631303449d8102982ea5cb92a29e51aeebe24d40c4ffe58814fa49da08fef5eb5a91217da977f45e25b8fd8b3a31824e408510d644712

  • memory/8-145-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/8-146-0x0000000004610000-0x000000000462A000-memory.dmp

    Filesize

    104KB

  • memory/8-147-0x0000000007220000-0x000000000771E000-memory.dmp

    Filesize

    5.0MB

  • memory/8-148-0x0000000004730000-0x0000000004748000-memory.dmp

    Filesize

    96KB

  • memory/8-149-0x0000000007210000-0x0000000007220000-memory.dmp

    Filesize

    64KB

  • memory/8-150-0x0000000007210000-0x0000000007220000-memory.dmp

    Filesize

    64KB

  • memory/8-151-0x0000000007210000-0x0000000007220000-memory.dmp

    Filesize

    64KB

  • memory/8-152-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-153-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-155-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-157-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-159-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-161-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-165-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-163-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-167-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-169-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-171-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-173-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-175-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-177-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-179-0x0000000004730000-0x0000000004742000-memory.dmp

    Filesize

    72KB

  • memory/8-180-0x0000000000400000-0x0000000002B1A000-memory.dmp

    Filesize

    39.1MB

  • memory/8-182-0x0000000000400000-0x0000000002B1A000-memory.dmp

    Filesize

    39.1MB

  • memory/3032-187-0x0000000004890000-0x00000000048D6000-memory.dmp

    Filesize

    280KB

  • memory/3032-222-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-188-0x0000000002D30000-0x0000000002D7B000-memory.dmp

    Filesize

    300KB

  • memory/3032-190-0x0000000004C50000-0x0000000004C94000-memory.dmp

    Filesize

    272KB

  • memory/3032-191-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/3032-192-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/3032-193-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-194-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-196-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-198-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-200-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-202-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-204-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-206-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-208-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-210-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-212-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-214-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-216-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-218-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-220-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-189-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/3032-224-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-226-0x0000000004C50000-0x0000000004C8E000-memory.dmp

    Filesize

    248KB

  • memory/3032-1099-0x0000000007E20000-0x0000000008426000-memory.dmp

    Filesize

    6.0MB

  • memory/3032-1100-0x00000000071B0000-0x00000000072BA000-memory.dmp

    Filesize

    1.0MB

  • memory/3032-1101-0x0000000007810000-0x0000000007822000-memory.dmp

    Filesize

    72KB

  • memory/3032-1102-0x0000000007830000-0x000000000786E000-memory.dmp

    Filesize

    248KB

  • memory/3032-1103-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/3032-1104-0x0000000007970000-0x00000000079BB000-memory.dmp

    Filesize

    300KB

  • memory/3032-1106-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/3032-1107-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/3032-1108-0x0000000007B00000-0x0000000007B92000-memory.dmp

    Filesize

    584KB

  • memory/3032-1109-0x0000000007BA0000-0x0000000007C06000-memory.dmp

    Filesize

    408KB

  • memory/3032-1110-0x0000000009C60000-0x0000000009E22000-memory.dmp

    Filesize

    1.8MB

  • memory/3032-1111-0x0000000009E30000-0x000000000A35C000-memory.dmp

    Filesize

    5.2MB

  • memory/3032-1113-0x000000000A410000-0x000000000A486000-memory.dmp

    Filesize

    472KB

  • memory/3032-1114-0x000000000A490000-0x000000000A4E0000-memory.dmp

    Filesize

    320KB

  • memory/3032-1115-0x0000000007300000-0x0000000007310000-memory.dmp

    Filesize

    64KB

  • memory/4124-1121-0x00000000007E0000-0x0000000000812000-memory.dmp

    Filesize

    200KB

  • memory/4124-1122-0x0000000005220000-0x000000000526B000-memory.dmp

    Filesize

    300KB

  • memory/4124-1123-0x00000000053D0000-0x00000000053E0000-memory.dmp

    Filesize

    64KB

  • memory/4540-139-0x0000000000AF0000-0x0000000000AFA000-memory.dmp

    Filesize

    40KB