Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2023, 14:27
Static task
static1
Behavioral task
behavioral1
Sample
b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe
Resource
win10v2004-20230220-en
General
-
Target
b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe
-
Size
684KB
-
MD5
eb8d0e139e38e6230908af26fbe15e45
-
SHA1
956af3bfaaacbf8eaa699cb785e341aea81ce6cf
-
SHA256
b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d
-
SHA512
c99d2cb7e717086e16ad56df850b9a04d965cc3c8e0187a417368e9c9415dc19acb51cd8a0671b6f421b1d6f13266a4f6d2cea93179ae7cca45a6371d6fe636f
-
SSDEEP
12288:W2p6IH/YF4pPp9BkMNVxauA6aFKm941l3qrKaPG4Lk2faSKVJ8ekcxAe:W2zpPpnkOVxa/68KZl3UKaPG4Lk2/KVf
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
gena
193.233.20.32:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr529169.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr529169.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr529169.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr529169.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr529169.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr529169.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 32 IoCs
resource yara_rule behavioral1/memory/324-160-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-163-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-165-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-161-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-167-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-169-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-171-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-173-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-175-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-179-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-177-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-181-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-183-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-185-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-187-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-189-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-191-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-193-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-195-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-197-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-199-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-201-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-203-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-205-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-207-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-209-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-211-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-213-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-217-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-215-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-219-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline behavioral1/memory/324-221-0x0000000004C00000-0x0000000004C3F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 1992 zinN6544.exe 632 jr529169.exe 324 ku522736.exe 4052 lr961330.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr529169.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zinN6544.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zinN6544.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3828 324 WerFault.exe 86 2312 4628 WerFault.exe 81 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 632 jr529169.exe 632 jr529169.exe 324 ku522736.exe 324 ku522736.exe 4052 lr961330.exe 4052 lr961330.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 632 jr529169.exe Token: SeDebugPrivilege 324 ku522736.exe Token: SeDebugPrivilege 4052 lr961330.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4628 wrote to memory of 1992 4628 b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe 82 PID 4628 wrote to memory of 1992 4628 b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe 82 PID 4628 wrote to memory of 1992 4628 b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe 82 PID 1992 wrote to memory of 632 1992 zinN6544.exe 83 PID 1992 wrote to memory of 632 1992 zinN6544.exe 83 PID 1992 wrote to memory of 324 1992 zinN6544.exe 86 PID 1992 wrote to memory of 324 1992 zinN6544.exe 86 PID 1992 wrote to memory of 324 1992 zinN6544.exe 86 PID 4628 wrote to memory of 4052 4628 b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe 89 PID 4628 wrote to memory of 4052 4628 b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe 89 PID 4628 wrote to memory of 4052 4628 b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe"C:\Users\Admin\AppData\Local\Temp\b0700a9c020b17a87b7447fdc376a04affa76933b0b11a242388857a39f01f0d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinN6544.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zinN6544.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr529169.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr529169.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku522736.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku522736.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 17844⤵
- Program crash
PID:3828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr961330.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr961330.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4052
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 4762⤵
- Program crash
PID:2312
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 324 -ip 3241⤵PID:1196
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4628 -ip 46281⤵PID:2380
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5f50023c2c4bad1bbf51efde95c575b28
SHA19e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1
SHA256a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb
SHA512d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57
-
Filesize
175KB
MD5f50023c2c4bad1bbf51efde95c575b28
SHA19e02fe5ecc82f471d8c078a0d4b9ce02fdf69ce1
SHA256a491d4a9a89a7103f18f402d20df34f1ae56d18bc779ff8a4681f52a3e65cbdb
SHA512d869c3c475811fdce251a700556018d98c639c28ec838f31e0fb3a9f91743843393d77735f14b992a7407356d109b680e2b9687385bae2ed7ffaef88b7c9fa57
-
Filesize
398KB
MD5cfb2eb242bb0e63df5142c30521388d6
SHA1c793082cd9502cd7b1131a74dddc28bcb38adf8d
SHA25650f0911b2b148deca7239749036458e857bc742d9cd3166d6d6596d0577403c3
SHA512715303f6c1017b872d7966210f03e281563414a88897584d7576c26d18bce7ade495cc5735a1eac02fabbcefd6cbc6da94a19d6f80b5d216b036ba47aa6d9528
-
Filesize
398KB
MD5cfb2eb242bb0e63df5142c30521388d6
SHA1c793082cd9502cd7b1131a74dddc28bcb38adf8d
SHA25650f0911b2b148deca7239749036458e857bc742d9cd3166d6d6596d0577403c3
SHA512715303f6c1017b872d7966210f03e281563414a88897584d7576c26d18bce7ade495cc5735a1eac02fabbcefd6cbc6da94a19d6f80b5d216b036ba47aa6d9528
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
357KB
MD5f7b1f3086ead97c7fcd8eae485eec5a1
SHA14b41edab1ef531e7a5e983e193d50fbde97b7c98
SHA256ffc243f5025ef8fd5a181ab1447fafb33153aba4a963dcb66a80f1624c2e23ad
SHA512f6d265946280be35fb4899ccb3f8089f8524f8b69636285dcf2868452a6922df9c769f7bc73def6262dacdbcab90afeeab3d99e030932bee136ba9dfcb9eca62
-
Filesize
357KB
MD5f7b1f3086ead97c7fcd8eae485eec5a1
SHA14b41edab1ef531e7a5e983e193d50fbde97b7c98
SHA256ffc243f5025ef8fd5a181ab1447fafb33153aba4a963dcb66a80f1624c2e23ad
SHA512f6d265946280be35fb4899ccb3f8089f8524f8b69636285dcf2868452a6922df9c769f7bc73def6262dacdbcab90afeeab3d99e030932bee136ba9dfcb9eca62