Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
24/03/2023, 05:40 UTC
General
-
Target
70f06877c96200c33fd9c07fd24cdb2ed5b06f5de488c8a23104f8d9a7e54f7f.exe
-
Size
546KB
-
MD5
9796bf79df3d1e093e946b0239a0ac86
-
SHA1
5bca49b0f5fe78de9af872ef54850f0fa7aed189
-
SHA256
70f06877c96200c33fd9c07fd24cdb2ed5b06f5de488c8a23104f8d9a7e54f7f
-
SHA512
61ecc581a5f674f09c0a5bb5ebc02608720b8f14a035c86ce6167405d90b5586dfe4a0a5dd2534c556b42a906dbde563551c9cea690cbbee4ab71104a5cc7c48
-
SSDEEP
12288:fMrqy901Wsj+vkE86hBfrsjlKjrI9ktfwLMh8cz5EzBf/S:xywWs6J86hBDsjE4a69cS9f/S
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
hero
193.233.20.31:4125
-
auth_value
11f3c75a88ca461bcc8d6bf60a1193e3
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\70f06877c96200c33fd9c07fd24cdb2ed5b06f5de488c8a23104f8d9a7e54f7f.exe"C:\Users\Admin\AppData\Local\Temp\70f06877c96200c33fd9c07fd24cdb2ed5b06f5de488c8a23104f8d9a7e54f7f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6607.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\unio6607.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1763.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1763.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2868.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2868.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 13404⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si693173.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si693173.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 860 -ip 8601⤵
Network
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse -
DNS76.38.195.152.in-addr.arpaRemote address:8.8.8.8:53Request76.38.195.152.in-addr.arpaIN PTRResponse
-
DNS73.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
DNS210.81.184.52.in-addr.arpaRemote address:8.8.8.8:53Request210.81.184.52.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS31.20.233.193.in-addr.arpaRemote address:8.8.8.8:53Request31.20.233.193.in-addr.arpaIN PTRResponse
-
DNS177.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request177.238.32.23.in-addr.arpaIN PTRResponse177.238.32.23.in-addr.arpaIN PTRa23-32-238-177deploystaticakamaitechnologiescom
-
DNS234.238.32.23.in-addr.arpaRemote address:8.8.8.8:53Request234.238.32.23.in-addr.arpaIN PTRResponse234.238.32.23.in-addr.arpaIN PTRa23-32-238-234deploystaticakamaitechnologiescom
-
84.53.175.11:80 -
84.53.175.11:80
-
193.233.20.31:4125 -
193.233.20.31:4125
-
173.223.113.164:443
-
209.197.3.8:80
-
209.197.3.8:80
-
93.184.220.29:80
-
204.79.197.203:80
-
173.223.113.131:80
-
204.79.197.203:80
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5376.38.195.152.in-addr.arpadns
DNS Request
76.38.195.152.in-addr.arpa
-
8.8.8.8:5373.159.190.20.in-addr.arpadns
DNS Request
73.159.190.20.in-addr.arpa
-
8.8.8.8:53210.81.184.52.in-addr.arpadns
DNS Request
210.81.184.52.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:5331.20.233.193.in-addr.arpadns
DNS Request
31.20.233.193.in-addr.arpa
-
8.8.8.8:53177.238.32.23.in-addr.arpadns
DNS Request
177.238.32.23.in-addr.arpa
-
8.8.8.8:53234.238.32.23.in-addr.arpadns
DNS Request
234.238.32.23.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
Filesize
175KB
MD57c11dfe7837f2079d50113de0e973682
SHA1fae072addd4d56ab67d08ab82da4aac5d7223960
SHA256442d9cc0073a6d45abbed64eb9891912091d444fe4dd368924d1b8cf7c59e65b
SHA51206085d23ead5955185736af64754c343a796af98b68c8013ba20b19a5c52eb92066698b86633d54438fe6ad5455c3c3c4625cf03d15439ab486e22388bd8cab7
-
Filesize
404KB
MD5267f820e731d9d70553f7366f0cb03b5
SHA13f8b03e0ba1529bf9704fd5f2f7447859e48c3d8
SHA256eabd5b9cbc2e76a3745d9cb679b39f20c079ac98222bf8371d4dca3b97d062f8
SHA5129bba5e441f6e73e1b1ccd923f9296243659e704835705d150b5e928b6bccb2dff7a191c014e942ed218670a403f08a1eb76fbc92ff3d44c108b86659c5a0cce8
-
Filesize
404KB
MD5267f820e731d9d70553f7366f0cb03b5
SHA13f8b03e0ba1529bf9704fd5f2f7447859e48c3d8
SHA256eabd5b9cbc2e76a3745d9cb679b39f20c079ac98222bf8371d4dca3b97d062f8
SHA5129bba5e441f6e73e1b1ccd923f9296243659e704835705d150b5e928b6bccb2dff7a191c014e942ed218670a403f08a1eb76fbc92ff3d44c108b86659c5a0cce8
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
358KB
MD5fce8f10c1bcc5d676beca171d9be2f0d
SHA1e42ba1233af269262fe7c7d327899c3a7fb1c33c
SHA256ab1f2d87af6baaa011a3c64fa3cbbaa9201319e9075f04ec9cf498aaca06266a
SHA51295c18273aa733ca7039a7712db5b6a5cd77ae5464f1b0623e34306d6484977abe0147b2613ceb2d135dac29aaba839864f9e727f0369ec32ec24bcbcd884d244
-
Filesize
358KB
MD5fce8f10c1bcc5d676beca171d9be2f0d
SHA1e42ba1233af269262fe7c7d327899c3a7fb1c33c
SHA256ab1f2d87af6baaa011a3c64fa3cbbaa9201319e9075f04ec9cf498aaca06266a
SHA51295c18273aa733ca7039a7712db5b6a5cd77ae5464f1b0623e34306d6484977abe0147b2613ceb2d135dac29aaba839864f9e727f0369ec32ec24bcbcd884d244
-
Filesize
40KB
-
Filesize
300KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
200KB
-
Filesize
64KB