Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2023, 08:12

General

  • Target

    4168bcb668121c9cfbfe2cfc8f5ebbaafc46b69d51a75b7c54bbdffcce49e52f.exe

  • Size

    381KB

  • MD5

    75cdad6d99a664b7cc69945de3dd20d0

  • SHA1

    e475df28cfb87284d45f324dd4e1ecd69f56821e

  • SHA256

    4168bcb668121c9cfbfe2cfc8f5ebbaafc46b69d51a75b7c54bbdffcce49e52f

  • SHA512

    4038f770066b21ea21189ed786f43cd2b899c7f507901bb081fdcff8708308806bec3aac9c86223874a3f499f6067d4480cce84744755716560131100d10e563

  • SSDEEP

    6144:DfKed7SZsUtRuVhRGCSjvK4LRkBFRDtzIOTfm:jKed7IsAYVhRbSjvvN0LTm

Malware Config

Extracted

Family

redline

Botnet

@chicago

C2

185.11.61.125:22344

Attributes
  • auth_value

    21f863e0cbd09d0681058e068d0d1d7f

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4168bcb668121c9cfbfe2cfc8f5ebbaafc46b69d51a75b7c54bbdffcce49e52f.exe
    "C:\Users\Admin\AppData\Local\Temp\4168bcb668121c9cfbfe2cfc8f5ebbaafc46b69d51a75b7c54bbdffcce49e52f.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3184
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 1764
      2⤵
      • Program crash
      PID:3336
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3184 -ip 3184
    1⤵
      PID:3664

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3184-134-0x0000000004900000-0x0000000004962000-memory.dmp

      Filesize

      392KB

    • memory/3184-135-0x0000000007380000-0x0000000007924000-memory.dmp

      Filesize

      5.6MB

    • memory/3184-136-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-137-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-139-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-141-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-143-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-145-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-147-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-149-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-151-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-153-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-155-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-158-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-160-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-162-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-157-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-161-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-164-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-166-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-170-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-168-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-172-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-174-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-176-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-178-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-180-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-182-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-184-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-186-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-188-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-190-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-192-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-194-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-196-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-200-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-198-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-202-0x00000000072E0000-0x0000000007332000-memory.dmp

      Filesize

      328KB

    • memory/3184-929-0x0000000007930000-0x0000000007F48000-memory.dmp

      Filesize

      6.1MB

    • memory/3184-930-0x0000000007FB0000-0x0000000007FC2000-memory.dmp

      Filesize

      72KB

    • memory/3184-931-0x0000000007FD0000-0x00000000080DA000-memory.dmp

      Filesize

      1.0MB

    • memory/3184-932-0x00000000080E0000-0x000000000811C000-memory.dmp

      Filesize

      240KB

    • memory/3184-934-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-935-0x00000000083F0000-0x0000000008456000-memory.dmp

      Filesize

      408KB

    • memory/3184-936-0x0000000008C00000-0x0000000008C92000-memory.dmp

      Filesize

      584KB

    • memory/3184-937-0x0000000008CB0000-0x0000000008D26000-memory.dmp

      Filesize

      472KB

    • memory/3184-938-0x0000000004900000-0x0000000004962000-memory.dmp

      Filesize

      392KB

    • memory/3184-939-0x0000000008D70000-0x0000000008D8E000-memory.dmp

      Filesize

      120KB

    • memory/3184-940-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-941-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-942-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB

    • memory/3184-943-0x0000000008E10000-0x0000000008FD2000-memory.dmp

      Filesize

      1.8MB

    • memory/3184-944-0x0000000008FF0000-0x000000000951C000-memory.dmp

      Filesize

      5.2MB

    • memory/3184-947-0x0000000007370000-0x0000000007380000-memory.dmp

      Filesize

      64KB