Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
113s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23/03/2023, 01:01
Static task
static1
Behavioral task
behavioral1
Sample
e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe
Resource
win10v2004-20230220-en
General
-
Target
e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe
-
Size
540KB
-
MD5
f24d9c2cb2367f352ed8681ff43468da
-
SHA1
1c8df11fca6a94321a15e89d4139675850188464
-
SHA256
e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389
-
SHA512
48e0053d04af8a132d226109ed982169d03149829e47a84146e7d6af1703ed5ba2eeda4d71e90f9d903b461ea494b44e4c494d93dc53719b81e837a7cbe008d0
-
SSDEEP
12288:kMrUy90Kqx4mnmz28nF8Jx3ta0Rf06ZRdQQTAgGlP:gyO7nwdnOJBbjRdQQuP
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
real
193.233.20.31:4125
-
auth_value
bb22a50228754849387d5f4d1611e71b
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pro0303.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pro0303.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pro0303.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection pro0303.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pro0303.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pro0303.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
resource yara_rule behavioral1/memory/4128-154-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-155-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-157-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-159-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-161-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-163-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-165-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-167-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-169-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-171-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-173-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-175-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-177-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-180-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-181-0x0000000004D10000-0x0000000004D20000-memory.dmp family_redline behavioral1/memory/4128-184-0x0000000004D10000-0x0000000004D20000-memory.dmp family_redline behavioral1/memory/4128-183-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-187-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-189-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-191-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-193-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-195-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-197-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-199-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-201-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-203-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-205-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-207-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-209-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-211-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-213-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-215-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-217-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-219-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-221-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/4128-1074-0x0000000004D10000-0x0000000004D20000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 1880 unio2477.exe 932 pro0303.exe 4128 qu3984.exe 3736 si859348.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" pro0303.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" unio2477.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce unio2477.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1548 4128 WerFault.exe 88 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 932 pro0303.exe 932 pro0303.exe 4128 qu3984.exe 4128 qu3984.exe 3736 si859348.exe 3736 si859348.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 932 pro0303.exe Token: SeDebugPrivilege 4128 qu3984.exe Token: SeDebugPrivilege 3736 si859348.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3184 wrote to memory of 1880 3184 e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe 86 PID 3184 wrote to memory of 1880 3184 e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe 86 PID 3184 wrote to memory of 1880 3184 e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe 86 PID 1880 wrote to memory of 932 1880 unio2477.exe 87 PID 1880 wrote to memory of 932 1880 unio2477.exe 87 PID 1880 wrote to memory of 4128 1880 unio2477.exe 88 PID 1880 wrote to memory of 4128 1880 unio2477.exe 88 PID 1880 wrote to memory of 4128 1880 unio2477.exe 88 PID 3184 wrote to memory of 3736 3184 e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe 91 PID 3184 wrote to memory of 3736 3184 e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe 91 PID 3184 wrote to memory of 3736 3184 e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe"C:\Users\Admin\AppData\Local\Temp\e6874a13df751d7375ef0734701f1eb39325bc65ed754b94d4be414f56341389.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2477.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio2477.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0303.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0303.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3984.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu3984.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4128 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 13324⤵
- Program crash
PID:1548
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si859348.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si859348.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4128 -ip 41281⤵PID:1800
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
175KB
MD541707338e1e2d868aa699ac0dd2e77b0
SHA136e0dfba09f9fb409faf0f9a99217d0d0c524b82
SHA2568d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557
SHA51280c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2
-
Filesize
397KB
MD50a8ac6cf78d83cbaf54a5415c455c43e
SHA1d3236989ac0ab2b594de7b278931d5df952cc284
SHA256a46260968db68f23d241ecfa44689d39b1265aaf508cab185c949b3ccb9379cb
SHA5125973dc008718528315ec47037d9351675285745ff63a8b56bf9a8918cba05560ed0ad4f229b8eeecf174f997349a893fd8600a86b4d5f1a0104fd49cedc92a67
-
Filesize
397KB
MD50a8ac6cf78d83cbaf54a5415c455c43e
SHA1d3236989ac0ab2b594de7b278931d5df952cc284
SHA256a46260968db68f23d241ecfa44689d39b1265aaf508cab185c949b3ccb9379cb
SHA5125973dc008718528315ec47037d9351675285745ff63a8b56bf9a8918cba05560ed0ad4f229b8eeecf174f997349a893fd8600a86b4d5f1a0104fd49cedc92a67
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
357KB
MD531817c4b6f6d9009f84b889e3592dd80
SHA16490268352b44100ca26d880580f84965d156091
SHA256c421155d80e8dd47eb1ab0773bb2d8e688e50d94ea10a79f98c9441cb3a4c3fb
SHA512d6d9fb7a07a0adf56aacd00a6c72a0cf3de3c2ae26c9768cfb5ba8f55e15f3e7c7af462c7f6532bbf4e782ad759d965bea6201223b8b9d9ed1360153c184570c
-
Filesize
357KB
MD531817c4b6f6d9009f84b889e3592dd80
SHA16490268352b44100ca26d880580f84965d156091
SHA256c421155d80e8dd47eb1ab0773bb2d8e688e50d94ea10a79f98c9441cb3a4c3fb
SHA512d6d9fb7a07a0adf56aacd00a6c72a0cf3de3c2ae26c9768cfb5ba8f55e15f3e7c7af462c7f6532bbf4e782ad759d965bea6201223b8b9d9ed1360153c184570c