Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
76s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
22/03/2023, 18:01 UTC
General
-
Target
3572c9b19e8c36dd9d0307b08511c0b1.exe
-
Size
538KB
-
MD5
3572c9b19e8c36dd9d0307b08511c0b1
-
SHA1
af40874ddfe51ca33ad35ee32a84908ede90dcf1
-
SHA256
e27f343d59451541202e9e87a12b98b7a6d8ff1f2031a014198b6312e6e8c5ac
-
SHA512
5777bf077cb0a01e955627e1be8ba5c077d955b121002bcc16fde13a9a1a63d12f8d420a6a033879ad8a507833560d366d748bf95956f00d27fc2c176dbc5fce
-
SSDEEP
12288:BMrsy90vu8UorljsOp35Dd/D4pHK+AwYt1M9wdiJyO09RWMUFK:FyChl11r/Drdnt1QwdJTUo
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
sint
193.233.20.31:4125
-
auth_value
9d9b763b4dcfbff1c06ef4743cc0399e
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3572c9b19e8c36dd9d0307b08511c0b1.exe"C:\Users\Admin\AppData\Local\Temp\3572c9b19e8c36dd9d0307b08511c0b1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba0550.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba0550.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h13Dw68.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h13Dw68.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iYIoK56.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iYIoK56.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 940 -s 15364⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l90Kg54.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l90Kg54.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 940 -ip 9401⤵
Network
-
DNS240.232.18.117.in-addr.arpaRemote address:8.8.8.8:53Request240.232.18.117.in-addr.arpaIN PTRResponse -
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
DNS28.143.109.104.in-addr.arpaRemote address:8.8.8.8:53Request28.143.109.104.in-addr.arpaIN PTRResponse28.143.109.104.in-addr.arpaIN PTRa104-109-143-28deploystaticakamaitechnologiescom
-
DNS58.104.205.20.in-addr.arpaRemote address:8.8.8.8:53Request58.104.205.20.in-addr.arpaIN PTRResponse
-
DNS161.252.72.23.in-addr.arpaRemote address:8.8.8.8:53Request161.252.72.23.in-addr.arpaIN PTRResponse161.252.72.23.in-addr.arpaIN PTRa23-72-252-161deploystaticakamaitechnologiescom
-
DNS123.108.74.40.in-addr.arpaRemote address:8.8.8.8:53Request123.108.74.40.in-addr.arpaIN PTRResponse
-
DNS31.20.233.193.in-addr.arpaRemote address:8.8.8.8:53Request31.20.233.193.in-addr.arpaIN PTRResponse
-
DNS76.38.195.152.in-addr.arpaRemote address:8.8.8.8:53Request76.38.195.152.in-addr.arpaIN PTRResponse
-
DNS160.252.72.23.in-addr.arpaRemote address:8.8.8.8:53Request160.252.72.23.in-addr.arpaIN PTRResponse160.252.72.23.in-addr.arpaIN PTRa23-72-252-160deploystaticakamaitechnologiescom
-
DNS44.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request44.8.109.52.in-addr.arpaIN PTRResponse
-
93.184.220.29:80
-
193.233.20.31:4125 -
193.233.20.31:4125
-
8.247.210.254:80
-
173.223.113.164:443
-
8.8.8.8:53240.232.18.117.in-addr.arpadns
DNS Request
240.232.18.117.in-addr.arpa
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5328.143.109.104.in-addr.arpadns
DNS Request
28.143.109.104.in-addr.arpa
-
8.8.8.8:5358.104.205.20.in-addr.arpadns
DNS Request
58.104.205.20.in-addr.arpa
-
8.8.8.8:53161.252.72.23.in-addr.arpadns
DNS Request
161.252.72.23.in-addr.arpa
-
8.8.8.8:53123.108.74.40.in-addr.arpadns
DNS Request
123.108.74.40.in-addr.arpa
-
8.8.8.8:5331.20.233.193.in-addr.arpadns
DNS Request
31.20.233.193.in-addr.arpa
-
8.8.8.8:5376.38.195.152.in-addr.arpadns
DNS Request
76.38.195.152.in-addr.arpa
-
8.8.8.8:53160.252.72.23.in-addr.arpadns
DNS Request
160.252.72.23.in-addr.arpa
-
8.8.8.8:5344.8.109.52.in-addr.arpadns
DNS Request
44.8.109.52.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD587d8308e8cda648f980eaded98c6dd64
SHA18e1213fea55c704c3d133c4b8675b99a66c08fc1
SHA256dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246
SHA51204add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200
-
Filesize
175KB
MD587d8308e8cda648f980eaded98c6dd64
SHA18e1213fea55c704c3d133c4b8675b99a66c08fc1
SHA256dfb2378d9e691c98c02a4ebd3196a313185549e72cd0d770972ea47888889246
SHA51204add36bd3e21f02b1fa836caddfbc0a0adfa480f18a369a5974bf98e093f17f36ab68251d5acdda4d8a94458451953b1fcf6ab7706b5e7125fc852c5dc71200
-
Filesize
396KB
MD5909068e613de7596881a4665f931dada
SHA1746f75b2f32a24f2089b83c2595fde6f6c6050c8
SHA25659640cf9968c81779a6aa14c085e5129a5b33210f555d7040de3d14b606bd9ff
SHA5127039be723d6066efbbbb572a740e4d40754a09b2d478b7f69c6024912619934bb1e7c08677890698914c3a0a42ad70c3c2a690d81b488b52a6d49463ed2880f7
-
Filesize
396KB
MD5909068e613de7596881a4665f931dada
SHA1746f75b2f32a24f2089b83c2595fde6f6c6050c8
SHA25659640cf9968c81779a6aa14c085e5129a5b33210f555d7040de3d14b606bd9ff
SHA5127039be723d6066efbbbb572a740e4d40754a09b2d478b7f69c6024912619934bb1e7c08677890698914c3a0a42ad70c3c2a690d81b488b52a6d49463ed2880f7
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
469KB
MD59c650f00776c29170a9fa99b1b48ee82
SHA101342a684ea86f28df2d20000ab69cffdca69dd8
SHA256a0f12b7ea69a1d353d158172a195898d8bc5b86023ea4997af0dc05da79178f2
SHA5120c223f54059a344eadd6a72aedadcc29874e7d6f2e8432bd14a9adc68520866fbb2eed25fcf880f2e5906b272ee032c5ca8afe7cf3dda0546371e9e4d5f988c0
-
Filesize
469KB
MD59c650f00776c29170a9fa99b1b48ee82
SHA101342a684ea86f28df2d20000ab69cffdca69dd8
SHA256a0f12b7ea69a1d353d158172a195898d8bc5b86023ea4997af0dc05da79178f2
SHA5120c223f54059a344eadd6a72aedadcc29874e7d6f2e8432bd14a9adc68520866fbb2eed25fcf880f2e5906b272ee032c5ca8afe7cf3dda0546371e9e4d5f988c0
-
Filesize
300KB
-
Filesize
5.6MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
40KB