Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
56s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/03/2023, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe
Resource
win10-20230220-en
General
-
Target
4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe
-
Size
544KB
-
MD5
8a3723cc43bfb0997af53ed07a00d24e
-
SHA1
97bf79909710b988ef87c1dd9b0ea30dd3a1ab45
-
SHA256
4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a
-
SHA512
404c92c84a585f3d226b2cf38f0b9ccc8e660b11882c0145d12b477ec8d2c526eb28f82cc3dccc2984be66f3ad0494d7809405d7ba14e2d34fc603e8689ed54c
-
SSDEEP
12288:CMrGy906Gfx+DVKVFbjpqgUfML/wPyjWR0I7:gyli+DIVFf3OMjhju0I7
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro1760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro1760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro1760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro1760.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro1760.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4392-139-0x0000000002470000-0x00000000024B6000-memory.dmp family_redline behavioral1/memory/4392-141-0x0000000002970000-0x00000000029B4000-memory.dmp family_redline behavioral1/memory/4392-146-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-147-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-149-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-151-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-153-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-155-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-157-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-161-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-159-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-163-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-165-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-167-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-169-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-171-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-173-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-175-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-177-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-179-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-181-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-183-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-185-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-187-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-189-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-191-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-193-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-195-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-197-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-199-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-201-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-203-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-205-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-207-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline behavioral1/memory/4392-209-0x0000000002970000-0x00000000029AE000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 3752 unio9118.exe 3748 pro1760.exe 4392 qu6172.exe 3924 si117396.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro1760.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio9118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio9118.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3748 pro1760.exe 3748 pro1760.exe 4392 qu6172.exe 4392 qu6172.exe 3924 si117396.exe 3924 si117396.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3748 pro1760.exe Token: SeDebugPrivilege 4392 qu6172.exe Token: SeDebugPrivilege 3924 si117396.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3992 wrote to memory of 3752 3992 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe 66 PID 3992 wrote to memory of 3752 3992 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe 66 PID 3992 wrote to memory of 3752 3992 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe 66 PID 3752 wrote to memory of 3748 3752 unio9118.exe 67 PID 3752 wrote to memory of 3748 3752 unio9118.exe 67 PID 3752 wrote to memory of 4392 3752 unio9118.exe 68 PID 3752 wrote to memory of 4392 3752 unio9118.exe 68 PID 3752 wrote to memory of 4392 3752 unio9118.exe 68 PID 3992 wrote to memory of 3924 3992 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe 70 PID 3992 wrote to memory of 3924 3992 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe 70 PID 3992 wrote to memory of 3924 3992 4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe"C:\Users\Admin\AppData\Local\Temp\4d5f803f44dbfc784fcbbf11d383e10b877ae950f7e899d5251764cc66d5176a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9118.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio9118.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1760.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1760.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6172.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6172.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si117396.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si117396.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
402KB
MD5ae3d5eca5141ed32338ff750e0350762
SHA1e0dda9b16ad8075e9b27af81937156db29ead599
SHA2560fd95e770e32122b4703143b4865996ad7b9fb632b71be316289a6af98e315b4
SHA512c01de749cb5b4fc4c820b940fd542f84648ad49f49278121011299871bdbd444c94cf4a4c812189cd335aa8c04d4ac37e02a67c675d420d353d1799b865d75b4
-
Filesize
402KB
MD5ae3d5eca5141ed32338ff750e0350762
SHA1e0dda9b16ad8075e9b27af81937156db29ead599
SHA2560fd95e770e32122b4703143b4865996ad7b9fb632b71be316289a6af98e315b4
SHA512c01de749cb5b4fc4c820b940fd542f84648ad49f49278121011299871bdbd444c94cf4a4c812189cd335aa8c04d4ac37e02a67c675d420d353d1799b865d75b4
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
349KB
MD5b100386daca6ed51c99e03561735a43c
SHA1e009d254c4a76c49db19e138645c680261980073
SHA256cc23def0bd1e6e3832ee6316db3f14d50d0a1f1e16d105087f13c3996df7604f
SHA51233bc0ba079f057ff7ab2c25551a1e7d9d8fdcf61254a300dd687cfbe0c1853831aff8b50ec3712364dfb222f377b2352aea1aa2cae7d977267a0757c57a39b46
-
Filesize
349KB
MD5b100386daca6ed51c99e03561735a43c
SHA1e009d254c4a76c49db19e138645c680261980073
SHA256cc23def0bd1e6e3832ee6316db3f14d50d0a1f1e16d105087f13c3996df7604f
SHA51233bc0ba079f057ff7ab2c25551a1e7d9d8fdcf61254a300dd687cfbe0c1853831aff8b50ec3712364dfb222f377b2352aea1aa2cae7d977267a0757c57a39b46