Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2023, 06:50

General

  • Target

    25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe

  • Size

    540KB

  • MD5

    9173e006c6e2b2c9315917ceb933f2a0

  • SHA1

    7f7212e413f8e21592a4996c05e5c82c7a3b1260

  • SHA256

    25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315

  • SHA512

    95c1a8b067c230f3f853293b9b2c7cec2888f546bb0da64a2ea45ee61e6b38d54ebb356b24da7efdb4ee828e9c4b6d2cd4b4189137ab59674e767f3043e07f31

  • SSDEEP

    12288:qMrSy90E8ckD+5xYh/sTTPNlh7DxhWAxY4Gm5B1xTd4Dwct:Myf8cqMllZ5xYE5BLTI

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

polo

C2

193.233.20.31:4125

Attributes
  • auth_value

    f1a1b1041a864e0f1f788d42ececa8b3

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe
    "C:\Users\Admin\AppData\Local\Temp\25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6651.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6651.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4044
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3966.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3966.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3840
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9422.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9422.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1672
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 1780
          4⤵
          • Program crash
          PID:4376
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si823062.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si823062.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5100
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1672 -ip 1672
    1⤵
      PID:3552

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si823062.exe

      Filesize

      175KB

      MD5

      44a26d7004f8b65e1a8bac0ccac86d6a

      SHA1

      30b583c2c04c1167703ae255b4d44b96b411c8ff

      SHA256

      37384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9

      SHA512

      17788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si823062.exe

      Filesize

      175KB

      MD5

      44a26d7004f8b65e1a8bac0ccac86d6a

      SHA1

      30b583c2c04c1167703ae255b4d44b96b411c8ff

      SHA256

      37384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9

      SHA512

      17788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6651.exe

      Filesize

      398KB

      MD5

      9831fcbb9f25a50b0b50479e653c787f

      SHA1

      29caa2f5be35de61003a266430719f3389909020

      SHA256

      18703f3cdb3780fffc7e56a0423627ac63e7c28d4c30dba8a234eb8ad69caa73

      SHA512

      86815df3eaf5f02999988db7180795182932fef05db3f06f2d75d6c189f0617af4bcba60192a3c2f0c506c18b0b0f0a4e49b5d9e54685024dfe9c7508f0d7208

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6651.exe

      Filesize

      398KB

      MD5

      9831fcbb9f25a50b0b50479e653c787f

      SHA1

      29caa2f5be35de61003a266430719f3389909020

      SHA256

      18703f3cdb3780fffc7e56a0423627ac63e7c28d4c30dba8a234eb8ad69caa73

      SHA512

      86815df3eaf5f02999988db7180795182932fef05db3f06f2d75d6c189f0617af4bcba60192a3c2f0c506c18b0b0f0a4e49b5d9e54685024dfe9c7508f0d7208

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3966.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3966.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9422.exe

      Filesize

      470KB

      MD5

      ee3002b6b2047615680af77a39c2f81a

      SHA1

      d139537c3d554ca442c2a4fc6603929e168ad615

      SHA256

      2f1ebee917cb4804c34859d30352dd9db415794799e8e2e10e23745315fda998

      SHA512

      17f482bba7fd98d20d6ad47772a242f929754ad3bda97084ac0ad49857a301541f2bf20e918183c19716541a91546d1844b05674fb8797b5bcbcfc538387b973

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9422.exe

      Filesize

      470KB

      MD5

      ee3002b6b2047615680af77a39c2f81a

      SHA1

      d139537c3d554ca442c2a4fc6603929e168ad615

      SHA256

      2f1ebee917cb4804c34859d30352dd9db415794799e8e2e10e23745315fda998

      SHA512

      17f482bba7fd98d20d6ad47772a242f929754ad3bda97084ac0ad49857a301541f2bf20e918183c19716541a91546d1844b05674fb8797b5bcbcfc538387b973

    • memory/1672-153-0x00000000005D0000-0x000000000061B000-memory.dmp

      Filesize

      300KB

    • memory/1672-154-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/1672-155-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/1672-156-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/1672-157-0x0000000004AB0000-0x0000000005054000-memory.dmp

      Filesize

      5.6MB

    • memory/1672-158-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-161-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-163-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-159-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-165-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-167-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-169-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-171-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-173-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-175-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-177-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-179-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-181-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-183-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-185-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-187-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-189-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-191-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-193-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-195-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-197-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-199-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-201-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-203-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-205-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-207-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-209-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-211-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-213-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-215-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-217-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-219-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-221-0x0000000005060000-0x000000000509E000-memory.dmp

      Filesize

      248KB

    • memory/1672-1064-0x0000000005100000-0x0000000005718000-memory.dmp

      Filesize

      6.1MB

    • memory/1672-1065-0x00000000057A0000-0x00000000058AA000-memory.dmp

      Filesize

      1.0MB

    • memory/1672-1066-0x00000000058E0000-0x00000000058F2000-memory.dmp

      Filesize

      72KB

    • memory/1672-1067-0x0000000005900000-0x000000000593C000-memory.dmp

      Filesize

      240KB

    • memory/1672-1068-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/1672-1070-0x0000000005BF0000-0x0000000005C82000-memory.dmp

      Filesize

      584KB

    • memory/1672-1071-0x0000000005C90000-0x0000000005CF6000-memory.dmp

      Filesize

      408KB

    • memory/1672-1073-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/1672-1072-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/1672-1074-0x00000000064F0000-0x00000000066B2000-memory.dmp

      Filesize

      1.8MB

    • memory/1672-1075-0x00000000066D0000-0x0000000006BFC000-memory.dmp

      Filesize

      5.2MB

    • memory/1672-1076-0x0000000006E40000-0x0000000006EB6000-memory.dmp

      Filesize

      472KB

    • memory/1672-1077-0x0000000006ED0000-0x0000000006F20000-memory.dmp

      Filesize

      320KB

    • memory/1672-1079-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

      Filesize

      64KB

    • memory/3840-147-0x0000000000F70000-0x0000000000F7A000-memory.dmp

      Filesize

      40KB

    • memory/5100-1084-0x00000000006B0000-0x00000000006E2000-memory.dmp

      Filesize

      200KB

    • memory/5100-1085-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

      Filesize

      64KB