Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2023, 00:15
Static task
static1
Behavioral task
behavioral1
Sample
fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe
Resource
win10v2004-20230220-en
General
-
Target
fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe
-
Size
192KB
-
MD5
d5ba7e786412f9d686e4377de5caeb8f
-
SHA1
00ddc056178956d46dacbfaa40fa779b28867e00
-
SHA256
fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7
-
SHA512
e9d6bbbeda04f6bdab9001e2b57980addb5754b766150a70cc730f28b0a224ae11fdffc65e7e34f81b2469b8fca5858863b00d8e51e101fb14d668bf3d1d844d
-
SSDEEP
3072:Kgy+bnr+O1n5GWp1icKAArDZz4N9GhbkrNEk1uTEqTuBppc2Feo7:Kgy+bnr+cp0yN90QET6Brh7
Malware Config
Extracted
redline
polo
193.233.20.31:4125
-
auth_value
f1a1b1041a864e0f1f788d42ececa8b3
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3094.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3094.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 2 IoCs
pid Process 4616 pro3094.exe 4952 si609132.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3094.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4616 pro3094.exe 4616 pro3094.exe 4952 si609132.exe 4952 si609132.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4616 pro3094.exe Token: SeDebugPrivilege 4952 si609132.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3172 wrote to memory of 4616 3172 fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe 87 PID 3172 wrote to memory of 4616 3172 fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe 87 PID 3172 wrote to memory of 4952 3172 fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe 91 PID 3172 wrote to memory of 4952 3172 fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe 91 PID 3172 wrote to memory of 4952 3172 fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe"C:\Users\Admin\AppData\Local\Temp\fa4035914b8deeb30943f7bad0ab9e48512ebce220bf7d366e492289584dcac7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro3094.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\pro3094.exe2⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si609132.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si609132.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4952
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
175KB
MD544a26d7004f8b65e1a8bac0ccac86d6a
SHA130b583c2c04c1167703ae255b4d44b96b411c8ff
SHA25637384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9
SHA51217788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b
-
Filesize
175KB
MD544a26d7004f8b65e1a8bac0ccac86d6a
SHA130b583c2c04c1167703ae255b4d44b96b411c8ff
SHA25637384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9
SHA51217788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b