Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
17/03/2023, 12:37 UTC
General
-
Target
b7bdc374fdc711fdcf398ec2700c208a7bc5960c23076f3835632acefdbacaa4.exe
-
Size
860KB
-
MD5
8544740f9adb3b9d42687323ee16a6f5
-
SHA1
0ead6ddf91ae890bda39678b492cc64af09720e4
-
SHA256
b7bdc374fdc711fdcf398ec2700c208a7bc5960c23076f3835632acefdbacaa4
-
SHA512
4807401018e88ec19749c7ad899fc4161f20f104a2755d9a4de6ac68754e1c430813bb794c3891b8496f9d864dd5a62325b0f0504423b6c6b0bb65e0b4d264ca
-
SSDEEP
24576:VyOtirLYWeZFVYIDq0WaJyWFSx3z8MFhk34JSrI:wYiZSdNWatcx3zEAS
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Extracted
redline
laba
193.233.20.28:4125
-
auth_value
2cf01cffff9092a85ca7e106c547190b
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
-
Executes dropped EXE 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Program crash 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7bdc374fdc711fdcf398ec2700c208a7bc5960c23076f3835632acefdbacaa4.exe"C:\Users\Admin\AppData\Local\Temp\b7bdc374fdc711fdcf398ec2700c208a7bc5960c23076f3835632acefdbacaa4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2580.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tice2580.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8150.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tice8150.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8394SB.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b8394SB.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c56fv13.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c56fv13.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 10805⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\durSO97.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\durSO97.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 13524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e74aY18.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\e74aY18.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4628 -ip 46281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4464 -ip 44641⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
-
DNS50.4.107.13.in-addr.arpaRemote address:8.8.8.8:53Request50.4.107.13.in-addr.arpaIN PTRResponse -
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
DNS76.38.195.152.in-addr.arpaRemote address:8.8.8.8:53Request76.38.195.152.in-addr.arpaIN PTRResponse
-
DNS210.81.184.52.in-addr.arpaRemote address:8.8.8.8:53Request210.81.184.52.in-addr.arpaIN PTRResponse
-
DNS28.20.233.193.in-addr.arpaRemote address:8.8.8.8:53Request28.20.233.193.in-addr.arpaIN PTRResponse
-
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS64.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request64.13.109.52.in-addr.arpaIN PTRResponse
-
DNS177.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request177.238.32.23.in-addr.arpaIN PTRResponse177.238.32.23.in-addr.arpaIN PTRa23-32-238-177deploystaticakamaitechnologiescom
-
117.18.232.240:80
-
193.233.20.28:4125 -
13.69.239.74:443 -
193.233.20.28:4125
-
117.18.232.240:80
-
117.18.232.240:80
-
173.223.113.164:443 -
173.223.113.131:80
-
131.253.33.203:80
-
8.255.132.126:80
-
8.8.8.8:5350.4.107.13.in-addr.arpadns
DNS Request
50.4.107.13.in-addr.arpa
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:5376.38.195.152.in-addr.arpadns
DNS Request
76.38.195.152.in-addr.arpa
-
8.8.8.8:53210.81.184.52.in-addr.arpadns
DNS Request
210.81.184.52.in-addr.arpa
-
8.8.8.8:5328.20.233.193.in-addr.arpadns
DNS Request
28.20.233.193.in-addr.arpa
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:5364.13.109.52.in-addr.arpadns
DNS Request
64.13.109.52.in-addr.arpa
-
8.8.8.8:53177.238.32.23.in-addr.arpadns
DNS Request
177.238.32.23.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5478e884952392c14b85cca1a6a4f3e35
SHA1f3475db1427fec3eedf583f1b7b0f839b27f8d74
SHA256bc576bf5f9a72ebbfbc11e59b8e384a1923eca8ec6c5234313c37865f74b7413
SHA512b3a1c504d2a108049a5ee193da2f1bcdd99d269e75f08199c3fccedc0de298996418421b5e48d5c0f582bf775087537ff8f83c341ed2c0cbbcf38e956bffebe9
-
Filesize
175KB
MD5478e884952392c14b85cca1a6a4f3e35
SHA1f3475db1427fec3eedf583f1b7b0f839b27f8d74
SHA256bc576bf5f9a72ebbfbc11e59b8e384a1923eca8ec6c5234313c37865f74b7413
SHA512b3a1c504d2a108049a5ee193da2f1bcdd99d269e75f08199c3fccedc0de298996418421b5e48d5c0f582bf775087537ff8f83c341ed2c0cbbcf38e956bffebe9
-
Filesize
715KB
MD5327bf0a34a2873d129c76003dab1fecd
SHA18a46ae5f37a3099f1dfd5a740e5fd588b5047a62
SHA256c0dd764a2e2cb158652825e6bc53fcd57d8918064daa4997edd4790f04da579f
SHA51291dfda83294d4f9430d12629de27d5c1c7fab34fffbeb5e74a2fa4e6d88095a78aec9fa7f6145986755aa8dd54113ffc5b46a5cbb67ef5da6da6ffb06498d48f
-
Filesize
715KB
MD5327bf0a34a2873d129c76003dab1fecd
SHA18a46ae5f37a3099f1dfd5a740e5fd588b5047a62
SHA256c0dd764a2e2cb158652825e6bc53fcd57d8918064daa4997edd4790f04da579f
SHA51291dfda83294d4f9430d12629de27d5c1c7fab34fffbeb5e74a2fa4e6d88095a78aec9fa7f6145986755aa8dd54113ffc5b46a5cbb67ef5da6da6ffb06498d48f
-
Filesize
396KB
MD5ce2853117c51c2faa654f694525afa1e
SHA132724da1c4813c3fdd140386372d5c9f5dd80f20
SHA256a618ebcbae55846e2b54d04b8f206f9bdeb5cea9003841151a81e7a8c6da399b
SHA512a43013ea6af3eb5493aafdfb983d7c3c5ec6c4ad46c12457749bb1a4cea78132597a4577b4e621922ed3f32c97ff018d92b3b3f6ffa05cc9ad07fa6fe5d61afe
-
Filesize
396KB
MD5ce2853117c51c2faa654f694525afa1e
SHA132724da1c4813c3fdd140386372d5c9f5dd80f20
SHA256a618ebcbae55846e2b54d04b8f206f9bdeb5cea9003841151a81e7a8c6da399b
SHA512a43013ea6af3eb5493aafdfb983d7c3c5ec6c4ad46c12457749bb1a4cea78132597a4577b4e621922ed3f32c97ff018d92b3b3f6ffa05cc9ad07fa6fe5d61afe
-
Filesize
358KB
MD5f7b97c22b945216662cd309a675cff4e
SHA195671acca4d7f366ae620bfa87548f79537a867e
SHA2569b1f98215e10669dae885a444228264c9940465a81e28a65e7c02225df7c7e11
SHA512b02c06a2eac829894daebc2564a0c42469706e8036ba63756beb1685d8ff6a5764d9e33282806471e9e409315fe87f0d7bbe20c05f65acae8a0229b4ca7d9b0b
-
Filesize
358KB
MD5f7b97c22b945216662cd309a675cff4e
SHA195671acca4d7f366ae620bfa87548f79537a867e
SHA2569b1f98215e10669dae885a444228264c9940465a81e28a65e7c02225df7c7e11
SHA512b02c06a2eac829894daebc2564a0c42469706e8036ba63756beb1685d8ff6a5764d9e33282806471e9e409315fe87f0d7bbe20c05f65acae8a0229b4ca7d9b0b
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
338KB
MD5a962f820dfe2cb378699191704cfdf32
SHA1e767a9ae1e186bdb91628b2734e42d6357f2c80a
SHA256872d9f819ee2c8ae303b76dc31e2ca5e475b17fc11a105eedc8d8d240c5b6aa6
SHA5129d8219ea5753caf3ff3266d5e0ae6bb2ac2a2fde8e22856be460174af97c38807924a3ec84e3dfdf7589d1cc085a0be815c5f1c75297482acbaa76ff78666a0f
-
Filesize
338KB
MD5a962f820dfe2cb378699191704cfdf32
SHA1e767a9ae1e186bdb91628b2734e42d6357f2c80a
SHA256872d9f819ee2c8ae303b76dc31e2ca5e475b17fc11a105eedc8d8d240c5b6aa6
SHA5129d8219ea5753caf3ff3266d5e0ae6bb2ac2a2fde8e22856be460174af97c38807924a3ec84e3dfdf7589d1cc085a0be815c5f1c75297482acbaa76ff78666a0f
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
320KB
-
Filesize
472KB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
1.0MB
-
Filesize
6.1MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
300KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
39.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
39.0MB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
180KB