Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
22/03/2023, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe
Resource
win10v2004-20230221-en
General
-
Target
25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe
-
Size
540KB
-
MD5
9173e006c6e2b2c9315917ceb933f2a0
-
SHA1
7f7212e413f8e21592a4996c05e5c82c7a3b1260
-
SHA256
25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315
-
SHA512
95c1a8b067c230f3f853293b9b2c7cec2888f546bb0da64a2ea45ee61e6b38d54ebb356b24da7efdb4ee828e9c4b6d2cd4b4189137ab59674e767f3043e07f31
-
SSDEEP
12288:qMrSy90E8ckD+5xYh/sTTPNlh7DxhWAxY4Gm5B1xTd4Dwct:Myf8cqMllZ5xYE5BLTI
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
polo
193.233.20.31:4125
-
auth_value
f1a1b1041a864e0f1f788d42ececa8b3
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro3966.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro3966.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro3966.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro3966.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro3966.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro3966.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
resource yara_rule behavioral1/memory/1672-158-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-161-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-163-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-159-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-165-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-167-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-169-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-171-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-173-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-175-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-177-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-179-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-181-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-183-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-185-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-187-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-189-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-191-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-193-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-195-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-197-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-199-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-201-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-203-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-205-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-207-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-209-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-211-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-213-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-215-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-217-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-219-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/1672-221-0x0000000005060000-0x000000000509E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 4044 unio6651.exe 3840 pro3966.exe 1672 qu9422.exe 5100 si823062.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro3966.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio6651.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio6651.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4376 1672 WerFault.exe 95 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3840 pro3966.exe 3840 pro3966.exe 1672 qu9422.exe 1672 qu9422.exe 5100 si823062.exe 5100 si823062.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3840 pro3966.exe Token: SeDebugPrivilege 1672 qu9422.exe Token: SeDebugPrivilege 5100 si823062.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1436 wrote to memory of 4044 1436 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe 87 PID 1436 wrote to memory of 4044 1436 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe 87 PID 1436 wrote to memory of 4044 1436 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe 87 PID 4044 wrote to memory of 3840 4044 unio6651.exe 88 PID 4044 wrote to memory of 3840 4044 unio6651.exe 88 PID 4044 wrote to memory of 1672 4044 unio6651.exe 95 PID 4044 wrote to memory of 1672 4044 unio6651.exe 95 PID 4044 wrote to memory of 1672 4044 unio6651.exe 95 PID 1436 wrote to memory of 5100 1436 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe 100 PID 1436 wrote to memory of 5100 1436 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe 100 PID 1436 wrote to memory of 5100 1436 25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe"C:\Users\Admin\AppData\Local\Temp\25f06c6c9ba43a983fde7c413f6040f7019c7e8f86f06d815610d444cfba0315.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6651.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6651.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3966.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3966.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9422.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9422.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 17804⤵
- Program crash
PID:4376
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si823062.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si823062.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1672 -ip 16721⤵PID:3552
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD544a26d7004f8b65e1a8bac0ccac86d6a
SHA130b583c2c04c1167703ae255b4d44b96b411c8ff
SHA25637384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9
SHA51217788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b
-
Filesize
175KB
MD544a26d7004f8b65e1a8bac0ccac86d6a
SHA130b583c2c04c1167703ae255b4d44b96b411c8ff
SHA25637384f1bfb6d2193e4ece0ed1f6989f9ebd238e7b4582e1aedfa136cdfd07eb9
SHA51217788355a5190ca17ead744cad71ebb7cfc7ceb84625310d31a469af0fbd50b2c304ce969530e99effeb0d23b0530b57a001f02fe918abc40ea68ad336fa187b
-
Filesize
398KB
MD59831fcbb9f25a50b0b50479e653c787f
SHA129caa2f5be35de61003a266430719f3389909020
SHA25618703f3cdb3780fffc7e56a0423627ac63e7c28d4c30dba8a234eb8ad69caa73
SHA51286815df3eaf5f02999988db7180795182932fef05db3f06f2d75d6c189f0617af4bcba60192a3c2f0c506c18b0b0f0a4e49b5d9e54685024dfe9c7508f0d7208
-
Filesize
398KB
MD59831fcbb9f25a50b0b50479e653c787f
SHA129caa2f5be35de61003a266430719f3389909020
SHA25618703f3cdb3780fffc7e56a0423627ac63e7c28d4c30dba8a234eb8ad69caa73
SHA51286815df3eaf5f02999988db7180795182932fef05db3f06f2d75d6c189f0617af4bcba60192a3c2f0c506c18b0b0f0a4e49b5d9e54685024dfe9c7508f0d7208
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
470KB
MD5ee3002b6b2047615680af77a39c2f81a
SHA1d139537c3d554ca442c2a4fc6603929e168ad615
SHA2562f1ebee917cb4804c34859d30352dd9db415794799e8e2e10e23745315fda998
SHA51217f482bba7fd98d20d6ad47772a242f929754ad3bda97084ac0ad49857a301541f2bf20e918183c19716541a91546d1844b05674fb8797b5bcbcfc538387b973
-
Filesize
470KB
MD5ee3002b6b2047615680af77a39c2f81a
SHA1d139537c3d554ca442c2a4fc6603929e168ad615
SHA2562f1ebee917cb4804c34859d30352dd9db415794799e8e2e10e23745315fda998
SHA51217f482bba7fd98d20d6ad47772a242f929754ad3bda97084ac0ad49857a301541f2bf20e918183c19716541a91546d1844b05674fb8797b5bcbcfc538387b973