Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    49s
  • max time network
    56s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    23/03/2023, 06:04

General

  • Target

    cf916784cce2d6878cf18165dee0dfaf592cf4fb1ce08b646ff43aad1fd0d800.exe

  • Size

    683KB

  • MD5

    e67f25a68fe994e46476bd665d94f2f2

  • SHA1

    15adc1c07c2233a8b36733e3521dfe7759271508

  • SHA256

    cf916784cce2d6878cf18165dee0dfaf592cf4fb1ce08b646ff43aad1fd0d800

  • SHA512

    2dc5e3ee131271961fdf66788f22dc2cb6f7c690b4d6f553cb974adf96a475673f60162bb738c655ad9f752a27ecdadb364798326327a73670ac78e5f33e18af

  • SSDEEP

    12288:hFMcNetDhl3Z3daj2u65rf8rs4KbhodaUYt6uEiGFMuwQmR47:hStDhI2Ri6+kHiijQt7

Malware Config

Extracted

Family

redline

Botnet

down

C2

193.233.20.31:4125

Attributes
  • auth_value

    12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

real

C2

193.233.20.31:4125

Attributes
  • auth_value

    bb22a50228754849387d5f4d1611e71b

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cf916784cce2d6878cf18165dee0dfaf592cf4fb1ce08b646ff43aad1fd0d800.exe
    "C:\Users\Admin\AppData\Local\Temp\cf916784cce2d6878cf18165dee0dfaf592cf4fb1ce08b646ff43aad1fd0d800.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYE9684.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYE9684.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr715891.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr715891.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku861812.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku861812.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3064
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr073830.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr073830.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr073830.exe

    Filesize

    175KB

    MD5

    41707338e1e2d868aa699ac0dd2e77b0

    SHA1

    36e0dfba09f9fb409faf0f9a99217d0d0c524b82

    SHA256

    8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

    SHA512

    80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr073830.exe

    Filesize

    175KB

    MD5

    41707338e1e2d868aa699ac0dd2e77b0

    SHA1

    36e0dfba09f9fb409faf0f9a99217d0d0c524b82

    SHA256

    8d2a5ba6ae16aa5ee13382edb585c480b6bf2db098427ffe5f8d55323ded7557

    SHA512

    80c66cbf19f6b2cc2e979b1fd1769cf45957761fa3f94b33fc194f88379b57ec9327a86ce374c6dc25334b44e4e8aa518a5d0d03ddb4f4eddfdfe8ddfc9fb6f2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYE9684.exe

    Filesize

    398KB

    MD5

    7df83585a810473c8243b949e82c9488

    SHA1

    54ab7bbead9c1f5ce9d624a99504dc1b0b48f2d8

    SHA256

    a11ccf603fe0126bd0091bceefb3d16a00d8910948c52e87049fff62c5ad9752

    SHA512

    2c7ef0106a88727929de8ebfb6b4d88db94ff76ba66db5ebb115095219533db11e1b5522b1888512536de3f8070fef8ab8b600fee51b869652dae60af351d9f0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziYE9684.exe

    Filesize

    398KB

    MD5

    7df83585a810473c8243b949e82c9488

    SHA1

    54ab7bbead9c1f5ce9d624a99504dc1b0b48f2d8

    SHA256

    a11ccf603fe0126bd0091bceefb3d16a00d8910948c52e87049fff62c5ad9752

    SHA512

    2c7ef0106a88727929de8ebfb6b4d88db94ff76ba66db5ebb115095219533db11e1b5522b1888512536de3f8070fef8ab8b600fee51b869652dae60af351d9f0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr715891.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr715891.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku861812.exe

    Filesize

    357KB

    MD5

    13e7e624257cc9c455c578c9f81f9a49

    SHA1

    1b199788834fafdc29e61faa5248fdcff58b2ec1

    SHA256

    cb0f9bcc63237bde069d4cb981587bc6cc152cf7fd6f6622c95c107427f5f1ff

    SHA512

    5678e88966ba0e312cf92b6b8763d177aae9bbd499457f5070f9b6e87750f4cf8e994c9643b7978e40325f9ea81111f10f2307f39c9f2ce0f2b1433e6c013c7b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku861812.exe

    Filesize

    357KB

    MD5

    13e7e624257cc9c455c578c9f81f9a49

    SHA1

    1b199788834fafdc29e61faa5248fdcff58b2ec1

    SHA256

    cb0f9bcc63237bde069d4cb981587bc6cc152cf7fd6f6622c95c107427f5f1ff

    SHA512

    5678e88966ba0e312cf92b6b8763d177aae9bbd499457f5070f9b6e87750f4cf8e994c9643b7978e40325f9ea81111f10f2307f39c9f2ce0f2b1433e6c013c7b

  • memory/2072-130-0x0000000006840000-0x00000000068C9000-memory.dmp

    Filesize

    548KB

  • memory/2072-140-0x0000000000400000-0x0000000002BD8000-memory.dmp

    Filesize

    39.8MB

  • memory/2592-139-0x00000000001B0000-0x00000000001BA000-memory.dmp

    Filesize

    40KB

  • memory/2848-1083-0x0000000005710000-0x0000000005720000-memory.dmp

    Filesize

    64KB

  • memory/2848-1082-0x0000000005600000-0x000000000564B000-memory.dmp

    Filesize

    300KB

  • memory/2848-1081-0x0000000000BD0000-0x0000000000C02000-memory.dmp

    Filesize

    200KB

  • memory/3064-189-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-173-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-155-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-157-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-171-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-183-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-195-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-209-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-211-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-207-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-205-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-291-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-295-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-292-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-203-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-201-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-199-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-197-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-193-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-191-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-153-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-187-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-185-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-181-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-179-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-177-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-175-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-150-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-169-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-167-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-165-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-163-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-161-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-159-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-1059-0x0000000007710000-0x0000000007D16000-memory.dmp

    Filesize

    6.0MB

  • memory/3064-1061-0x0000000007E70000-0x0000000007E82000-memory.dmp

    Filesize

    72KB

  • memory/3064-1060-0x0000000007D30000-0x0000000007E3A000-memory.dmp

    Filesize

    1.0MB

  • memory/3064-1062-0x0000000007E90000-0x0000000007ECE000-memory.dmp

    Filesize

    248KB

  • memory/3064-1063-0x0000000007FE0000-0x000000000802B000-memory.dmp

    Filesize

    300KB

  • memory/3064-1064-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-1067-0x0000000008170000-0x0000000008202000-memory.dmp

    Filesize

    584KB

  • memory/3064-1068-0x0000000008210000-0x0000000008276000-memory.dmp

    Filesize

    408KB

  • memory/3064-1069-0x0000000008B60000-0x0000000008D22000-memory.dmp

    Filesize

    1.8MB

  • memory/3064-1070-0x0000000008D40000-0x000000000926C000-memory.dmp

    Filesize

    5.2MB

  • memory/3064-1071-0x00000000093A0000-0x0000000009416000-memory.dmp

    Filesize

    472KB

  • memory/3064-1072-0x0000000009430000-0x0000000009480000-memory.dmp

    Filesize

    320KB

  • memory/3064-1074-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-1073-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-1075-0x0000000004950000-0x0000000004960000-memory.dmp

    Filesize

    64KB

  • memory/3064-151-0x0000000004AD0000-0x0000000004B0E000-memory.dmp

    Filesize

    248KB

  • memory/3064-148-0x0000000007210000-0x000000000770E000-memory.dmp

    Filesize

    5.0MB

  • memory/3064-149-0x0000000004AD0000-0x0000000004B14000-memory.dmp

    Filesize

    272KB

  • memory/3064-147-0x00000000048F0000-0x0000000004936000-memory.dmp

    Filesize

    280KB

  • memory/3064-146-0x0000000002C60000-0x0000000002CAB000-memory.dmp

    Filesize

    300KB