Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    77s
  • max time network
    99s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2023, 09:16

General

  • Target

    036809944f802c0d01171debecbf667738801574fa55e4e0917ffa568074d181.exe

  • Size

    723KB

  • MD5

    a2ddbbb7769be2b95a5d236fb8980901

  • SHA1

    040f955bd7bcaa000b421a5f236fa803bfcc1649

  • SHA256

    036809944f802c0d01171debecbf667738801574fa55e4e0917ffa568074d181

  • SHA512

    ce283ad9662bdf45512e3a33d636eb0162fbd26dae110801be75efdc009ce1e032726b7c160439d164d7baec6b3891733e7e4dfc185905c674eb98a3a0fd0455

  • SSDEEP

    12288:IMoRPakqGEOj018dfVphyPcsyBWoNQs+HfwQ7rUONwnJqCTlqb5I:IMoEGEFEhcGSj4eUooJqnby

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

firmu

C2

193.233.20.32:4125

Attributes
  • auth_value

    9f3e5e35e4a3a38fc36c5a851728aa33

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 32 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\036809944f802c0d01171debecbf667738801574fa55e4e0917ffa568074d181.exe
    "C:\Users\Admin\AppData\Local\Temp\036809944f802c0d01171debecbf667738801574fa55e4e0917ffa568074d181.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4796
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3376
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3520
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 1348
          4⤵
          • Program crash
          PID:3752
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 484
      2⤵
      • Program crash
      PID:3208
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3520 -ip 3520
    1⤵
      PID:1196
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4388 -ip 4388
      1⤵
        PID:1488

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe

        Filesize

        175KB

        MD5

        6b780eb9c71d7b15142e05f33765678b

        SHA1

        1b853b28e715a7c7a8e4a39567e7b22697265741

        SHA256

        2067ab13d0198979bf52e0b0e37bc9187cb178517620826424fc3c9f41c06d76

        SHA512

        a149005b933b4a7739cf723ee1fec219e8eb2019fbe5300a807383aae83c46e60d0fcd8f3b1f5cb8d85556ade4567db91ecdaa4fdbbc87350d5cb7b1f4274314

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe

        Filesize

        175KB

        MD5

        6b780eb9c71d7b15142e05f33765678b

        SHA1

        1b853b28e715a7c7a8e4a39567e7b22697265741

        SHA256

        2067ab13d0198979bf52e0b0e37bc9187cb178517620826424fc3c9f41c06d76

        SHA512

        a149005b933b4a7739cf723ee1fec219e8eb2019fbe5300a807383aae83c46e60d0fcd8f3b1f5cb8d85556ade4567db91ecdaa4fdbbc87350d5cb7b1f4274314

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe

        Filesize

        411KB

        MD5

        1b5b07d7a718982fa3f88f6e8eaf644d

        SHA1

        b2cc7cc0d5f1cc8f997e1d89b941d9555ac3a00c

        SHA256

        8c21e5557c053b2252d13f1db6cc77b5eca7a909bd361415666edc6b46560c68

        SHA512

        5d065111f7370951368ee4147c0d3a56b4a47768878fafe7449fbc761ccae8152065b0033a27a299653929101901c661ed044de380c6b900ef9f93b0b54b9318

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe

        Filesize

        411KB

        MD5

        1b5b07d7a718982fa3f88f6e8eaf644d

        SHA1

        b2cc7cc0d5f1cc8f997e1d89b941d9555ac3a00c

        SHA256

        8c21e5557c053b2252d13f1db6cc77b5eca7a909bd361415666edc6b46560c68

        SHA512

        5d065111f7370951368ee4147c0d3a56b4a47768878fafe7449fbc761ccae8152065b0033a27a299653929101901c661ed044de380c6b900ef9f93b0b54b9318

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe

        Filesize

        386KB

        MD5

        e4024b9734501ac5eb8949b5d963910d

        SHA1

        d9604cf792e7178f410cb074fefd857d64c62ed8

        SHA256

        93bf38ba1f53ad1680bfce795ae7be1eef7f1037af19f7241200732e4ff17c24

        SHA512

        8f49696233992965bc5e6966a2f769dee23a5b85acfc24b3cb9bbd9c008fdfb9858ff9372ef25586b91a3352c26b45b84afbed4fb89c4275966ed57d163b83c3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe

        Filesize

        386KB

        MD5

        e4024b9734501ac5eb8949b5d963910d

        SHA1

        d9604cf792e7178f410cb074fefd857d64c62ed8

        SHA256

        93bf38ba1f53ad1680bfce795ae7be1eef7f1037af19f7241200732e4ff17c24

        SHA512

        8f49696233992965bc5e6966a2f769dee23a5b85acfc24b3cb9bbd9c008fdfb9858ff9372ef25586b91a3352c26b45b84afbed4fb89c4275966ed57d163b83c3

      • memory/940-1091-0x0000000005980000-0x0000000005990000-memory.dmp

        Filesize

        64KB

      • memory/940-1090-0x0000000000D80000-0x0000000000DB2000-memory.dmp

        Filesize

        200KB

      • memory/3376-149-0x0000000000420000-0x000000000042A000-memory.dmp

        Filesize

        40KB

      • memory/3520-196-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-208-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-161-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-160-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-162-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-164-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-166-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-168-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-170-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-172-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-174-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-176-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-178-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-180-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-182-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-184-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-186-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-188-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-190-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-192-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-194-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-159-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-198-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-200-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-202-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-204-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-206-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-158-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-210-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-212-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-214-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-216-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-218-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-220-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-222-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/3520-1067-0x0000000007960000-0x0000000007F78000-memory.dmp

        Filesize

        6.1MB

      • memory/3520-1068-0x0000000007F80000-0x000000000808A000-memory.dmp

        Filesize

        1.0MB

      • memory/3520-1069-0x00000000080B0000-0x00000000080C2000-memory.dmp

        Filesize

        72KB

      • memory/3520-1070-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-1071-0x00000000080D0000-0x000000000810C000-memory.dmp

        Filesize

        240KB

      • memory/3520-1074-0x00000000083C0000-0x0000000008452000-memory.dmp

        Filesize

        584KB

      • memory/3520-1075-0x0000000008460000-0x00000000084C6000-memory.dmp

        Filesize

        408KB

      • memory/3520-1076-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-1077-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-1078-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-1079-0x0000000008B80000-0x0000000008D42000-memory.dmp

        Filesize

        1.8MB

      • memory/3520-1080-0x0000000008D60000-0x000000000928C000-memory.dmp

        Filesize

        5.2MB

      • memory/3520-1081-0x00000000072A0000-0x00000000072B0000-memory.dmp

        Filesize

        64KB

      • memory/3520-157-0x0000000002B90000-0x0000000002BDB000-memory.dmp

        Filesize

        300KB

      • memory/3520-156-0x00000000072B0000-0x0000000007854000-memory.dmp

        Filesize

        5.6MB

      • memory/3520-1082-0x00000000094D0000-0x0000000009546000-memory.dmp

        Filesize

        472KB

      • memory/3520-1083-0x0000000009560000-0x00000000095B0000-memory.dmp

        Filesize

        320KB

      • memory/4388-138-0x00000000049F0000-0x0000000004A7C000-memory.dmp

        Filesize

        560KB

      • memory/4388-150-0x0000000000400000-0x0000000002BE2000-memory.dmp

        Filesize

        39.9MB