Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    79s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2023, 05:24

General

  • Target

    ba7b5b60ef38b75add22d318c43b7d0be9f58fb6f8767da349c5853dd9b8a39e.exe

  • Size

    818KB

  • MD5

    df7507021f4eff06828c9bd74cdfb558

  • SHA1

    3139b14114b5075b64041527bbb9ffc7cba14ee5

  • SHA256

    ba7b5b60ef38b75add22d318c43b7d0be9f58fb6f8767da349c5853dd9b8a39e

  • SHA512

    07773c402e3cd10fe8171e1a9a16df701ad8b0380e5b2bf59ed3f3bfb89b6c321ca4f884932101de5fbffd5aad851f51944415e112f1cbbe4a5b30db67dad1ad

  • SSDEEP

    24576:ayRm2a3L1yyoIWKUVDoakCv8U4ukzEdS:h+t5AoakMGE

Malware Config

Extracted

Family

redline

Botnet

gena

C2

193.233.20.30:4125

Attributes
  • auth_value

    93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

ruka

C2

193.233.20.28:4125

Attributes
  • auth_value

    5d1d0e51ebe1e3f16cca573ff651c43c

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba7b5b60ef38b75add22d318c43b7d0be9f58fb6f8767da349c5853dd9b8a39e.exe
    "C:\Users\Admin\AppData\Local\Temp\ba7b5b60ef38b75add22d318c43b7d0be9f58fb6f8767da349c5853dd9b8a39e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4684
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6532.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6532.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba5565.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba5565.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2068
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4177ET.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4177ET.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1852
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h63ji63.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h63ji63.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:968
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 968 -s 1080
            5⤵
            • Program crash
            PID:1396
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iYZlw29.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iYZlw29.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 1332
          4⤵
          • Program crash
          PID:3728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l05sK25.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l05sK25.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3836
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 968 -ip 968
    1⤵
      PID:2232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4816 -ip 4816
      1⤵
        PID:1056

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l05sK25.exe

        Filesize

        175KB

        MD5

        6c4c2a56d5dd785adbe4fe60fa3cc1f2

        SHA1

        f8bd4379310258f8e54c47b56f5eec7394adb9a2

        SHA256

        b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2

        SHA512

        f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l05sK25.exe

        Filesize

        175KB

        MD5

        6c4c2a56d5dd785adbe4fe60fa3cc1f2

        SHA1

        f8bd4379310258f8e54c47b56f5eec7394adb9a2

        SHA256

        b182f2d3d49bdda2e29a0ed312deef4bee03983de54080c5e97ad6422de192d2

        SHA512

        f6958cab80e2f7736cea307b51be546e50acd5494b72db0343a09e6ef8c446114f51be6c9826fcb6e9f7190e4ec8415c0a403c3c1706183577c2604b877ff830

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6532.exe

        Filesize

        676KB

        MD5

        c780b6e000e5781df71814e47fcd982c

        SHA1

        fa379d635c1c6ba3fec717cabbe6b93208b0774b

        SHA256

        31a726d51dd573720c211f9332da2ec294e6da1a325467242ec4c4a998480191

        SHA512

        651907edc1e15991fa551e7e8c72083f109aef3ba3bf4090a26dc28f53c20f8cfaa818ab4712d2bc0d5e29ff005b0c6457a61d521c0a4f4fabe9e5ff79704a1a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba6532.exe

        Filesize

        676KB

        MD5

        c780b6e000e5781df71814e47fcd982c

        SHA1

        fa379d635c1c6ba3fec717cabbe6b93208b0774b

        SHA256

        31a726d51dd573720c211f9332da2ec294e6da1a325467242ec4c4a998480191

        SHA512

        651907edc1e15991fa551e7e8c72083f109aef3ba3bf4090a26dc28f53c20f8cfaa818ab4712d2bc0d5e29ff005b0c6457a61d521c0a4f4fabe9e5ff79704a1a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iYZlw29.exe

        Filesize

        349KB

        MD5

        4ccd8480fca39ab6d4af92abebe3c6e4

        SHA1

        a0326ebe17d1d5d1ca36e659eefe00efd2ab769b

        SHA256

        66b96305dfa726d3d32e36b153a215400b9906e2008c8e1b3a7dcfc89489119a

        SHA512

        437dc183217840d7daeffd8e9854f62493307633dd9a3de8254cd46e0934d8082b08acf1e38aa03f402aa1b08321a9a9025e09d3b94cb4b42091313b8160d17e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iYZlw29.exe

        Filesize

        349KB

        MD5

        4ccd8480fca39ab6d4af92abebe3c6e4

        SHA1

        a0326ebe17d1d5d1ca36e659eefe00efd2ab769b

        SHA256

        66b96305dfa726d3d32e36b153a215400b9906e2008c8e1b3a7dcfc89489119a

        SHA512

        437dc183217840d7daeffd8e9854f62493307633dd9a3de8254cd46e0934d8082b08acf1e38aa03f402aa1b08321a9a9025e09d3b94cb4b42091313b8160d17e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba5565.exe

        Filesize

        334KB

        MD5

        15840386e27dd13da1a569502f02b805

        SHA1

        8b218ea021549c66478cc93bda93e3f35d593900

        SHA256

        611cce3476373a22fd1ef74db02e7df23eabaae38652f14a1e1484d33994e5ff

        SHA512

        18500918a62f59733406c1eae43da820635dbd424691362d001ca09cf11d893f1b959241c5756e64633bc69fc68c118be47e34c8b2c89cc24b803607614da06b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\niba5565.exe

        Filesize

        334KB

        MD5

        15840386e27dd13da1a569502f02b805

        SHA1

        8b218ea021549c66478cc93bda93e3f35d593900

        SHA256

        611cce3476373a22fd1ef74db02e7df23eabaae38652f14a1e1484d33994e5ff

        SHA512

        18500918a62f59733406c1eae43da820635dbd424691362d001ca09cf11d893f1b959241c5756e64633bc69fc68c118be47e34c8b2c89cc24b803607614da06b

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4177ET.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f4177ET.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h63ji63.exe

        Filesize

        290KB

        MD5

        df4d375592d956ab758bf607a9620f61

        SHA1

        51471aa4069900e4d47c36840da5df969b734e29

        SHA256

        60d91e8c1cd936b2fbf3de067de20fa5ce7e033f1a52762e4fa7dec4bdd10af3

        SHA512

        ce98099f9fe3d7afa300c2fe70812c3a53e331e17dc158ab9bb279744694802f98c60e526fdd5d2612d9681f89edbb25e14e4f186ec2aa9c24f2a1639138648a

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h63ji63.exe

        Filesize

        290KB

        MD5

        df4d375592d956ab758bf607a9620f61

        SHA1

        51471aa4069900e4d47c36840da5df969b734e29

        SHA256

        60d91e8c1cd936b2fbf3de067de20fa5ce7e033f1a52762e4fa7dec4bdd10af3

        SHA512

        ce98099f9fe3d7afa300c2fe70812c3a53e331e17dc158ab9bb279744694802f98c60e526fdd5d2612d9681f89edbb25e14e4f186ec2aa9c24f2a1639138648a

      • memory/968-170-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-182-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-162-0x0000000004F40000-0x0000000004F50000-memory.dmp

        Filesize

        64KB

      • memory/968-163-0x0000000004F40000-0x0000000004F50000-memory.dmp

        Filesize

        64KB

      • memory/968-164-0x0000000004F40000-0x0000000004F50000-memory.dmp

        Filesize

        64KB

      • memory/968-165-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-166-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-168-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-160-0x0000000004F50000-0x00000000054F4000-memory.dmp

        Filesize

        5.6MB

      • memory/968-172-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-174-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-178-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-176-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-161-0x0000000000990000-0x00000000009BD000-memory.dmp

        Filesize

        180KB

      • memory/968-180-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-184-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-186-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-190-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-188-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-192-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

        Filesize

        72KB

      • memory/968-193-0x0000000000400000-0x0000000000830000-memory.dmp

        Filesize

        4.2MB

      • memory/968-194-0x0000000004F40000-0x0000000004F50000-memory.dmp

        Filesize

        64KB

      • memory/968-195-0x0000000004F40000-0x0000000004F50000-memory.dmp

        Filesize

        64KB

      • memory/968-196-0x0000000004F40000-0x0000000004F50000-memory.dmp

        Filesize

        64KB

      • memory/968-198-0x0000000000400000-0x0000000000830000-memory.dmp

        Filesize

        4.2MB

      • memory/1852-154-0x0000000000280000-0x000000000028A000-memory.dmp

        Filesize

        40KB

      • memory/3836-1134-0x00000000000D0000-0x0000000000102000-memory.dmp

        Filesize

        200KB

      • memory/3836-1135-0x0000000004C80000-0x0000000004C90000-memory.dmp

        Filesize

        64KB

      • memory/4816-204-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-208-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-212-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-206-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-214-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-218-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-216-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-220-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-222-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-224-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-226-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-232-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-236-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-234-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-230-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-228-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-297-0x00000000009C0000-0x0000000000A0B000-memory.dmp

        Filesize

        300KB

      • memory/4816-301-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-303-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-299-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-1113-0x00000000055A0000-0x0000000005BB8000-memory.dmp

        Filesize

        6.1MB

      • memory/4816-1114-0x0000000005C20000-0x0000000005D2A000-memory.dmp

        Filesize

        1.0MB

      • memory/4816-1115-0x0000000005D60000-0x0000000005D72000-memory.dmp

        Filesize

        72KB

      • memory/4816-1116-0x0000000005D80000-0x0000000005DBC000-memory.dmp

        Filesize

        240KB

      • memory/4816-1117-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-1118-0x0000000006070000-0x0000000006102000-memory.dmp

        Filesize

        584KB

      • memory/4816-1119-0x0000000006110000-0x0000000006176000-memory.dmp

        Filesize

        408KB

      • memory/4816-1121-0x0000000006810000-0x0000000006886000-memory.dmp

        Filesize

        472KB

      • memory/4816-1122-0x00000000068A0000-0x00000000068F0000-memory.dmp

        Filesize

        320KB

      • memory/4816-1123-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-1125-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-1124-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4816-1126-0x0000000006B90000-0x0000000006D52000-memory.dmp

        Filesize

        1.8MB

      • memory/4816-210-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-203-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

        Filesize

        248KB

      • memory/4816-1127-0x0000000006D60000-0x000000000728C000-memory.dmp

        Filesize

        5.2MB

      • memory/4816-1129-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB