Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2023, 10:16

General

  • Target

    e168042114377773eab70135c673970388c88536992b6d00b80ed8a9cb23a090.exe

  • Size

    723KB

  • MD5

    64d4b0e899d0f0635664c503f0850b7f

  • SHA1

    35946ead0a406dc9d9280528567d5e39992ca0f1

  • SHA256

    e168042114377773eab70135c673970388c88536992b6d00b80ed8a9cb23a090

  • SHA512

    58db8dae4951214be61808c5775f4b61ef6d341e1ab7215211f8c257e72685e95d28ea837cdac6b131bc889cc1c819fd42d168b2fb5a11e6df8642af2575c77a

  • SSDEEP

    12288:oMoRPakqGEOj018dfVphyPcsyBWoNQs+HfwQ7rUONwnJqCTlqb5I:oMoEGEFEhcGSj4eUooJqnby

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

firmu

C2

193.233.20.32:4125

Attributes
  • auth_value

    9f3e5e35e4a3a38fc36c5a851728aa33

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 32 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e168042114377773eab70135c673970388c88536992b6d00b80ed8a9cb23a090.exe
    "C:\Users\Admin\AppData\Local\Temp\e168042114377773eab70135c673970388c88536992b6d00b80ed8a9cb23a090.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3872
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:348
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:544
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 1328
          4⤵
          • Program crash
          PID:4584
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 484
      2⤵
      • Program crash
      PID:1060
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 544 -ip 544
    1⤵
      PID:1992
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1440 -ip 1440
      1⤵
        PID:3368

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe

        Filesize

        175KB

        MD5

        6b780eb9c71d7b15142e05f33765678b

        SHA1

        1b853b28e715a7c7a8e4a39567e7b22697265741

        SHA256

        2067ab13d0198979bf52e0b0e37bc9187cb178517620826424fc3c9f41c06d76

        SHA512

        a149005b933b4a7739cf723ee1fec219e8eb2019fbe5300a807383aae83c46e60d0fcd8f3b1f5cb8d85556ade4567db91ecdaa4fdbbc87350d5cb7b1f4274314

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr465439.exe

        Filesize

        175KB

        MD5

        6b780eb9c71d7b15142e05f33765678b

        SHA1

        1b853b28e715a7c7a8e4a39567e7b22697265741

        SHA256

        2067ab13d0198979bf52e0b0e37bc9187cb178517620826424fc3c9f41c06d76

        SHA512

        a149005b933b4a7739cf723ee1fec219e8eb2019fbe5300a807383aae83c46e60d0fcd8f3b1f5cb8d85556ade4567db91ecdaa4fdbbc87350d5cb7b1f4274314

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe

        Filesize

        411KB

        MD5

        1b5b07d7a718982fa3f88f6e8eaf644d

        SHA1

        b2cc7cc0d5f1cc8f997e1d89b941d9555ac3a00c

        SHA256

        8c21e5557c053b2252d13f1db6cc77b5eca7a909bd361415666edc6b46560c68

        SHA512

        5d065111f7370951368ee4147c0d3a56b4a47768878fafe7449fbc761ccae8152065b0033a27a299653929101901c661ed044de380c6b900ef9f93b0b54b9318

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziFN5078.exe

        Filesize

        411KB

        MD5

        1b5b07d7a718982fa3f88f6e8eaf644d

        SHA1

        b2cc7cc0d5f1cc8f997e1d89b941d9555ac3a00c

        SHA256

        8c21e5557c053b2252d13f1db6cc77b5eca7a909bd361415666edc6b46560c68

        SHA512

        5d065111f7370951368ee4147c0d3a56b4a47768878fafe7449fbc761ccae8152065b0033a27a299653929101901c661ed044de380c6b900ef9f93b0b54b9318

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr141352.exe

        Filesize

        11KB

        MD5

        7e93bacbbc33e6652e147e7fe07572a0

        SHA1

        421a7167da01c8da4dc4d5234ca3dd84e319e762

        SHA256

        850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

        SHA512

        250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe

        Filesize

        386KB

        MD5

        e4024b9734501ac5eb8949b5d963910d

        SHA1

        d9604cf792e7178f410cb074fefd857d64c62ed8

        SHA256

        93bf38ba1f53ad1680bfce795ae7be1eef7f1037af19f7241200732e4ff17c24

        SHA512

        8f49696233992965bc5e6966a2f769dee23a5b85acfc24b3cb9bbd9c008fdfb9858ff9372ef25586b91a3352c26b45b84afbed4fb89c4275966ed57d163b83c3

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku089808.exe

        Filesize

        386KB

        MD5

        e4024b9734501ac5eb8949b5d963910d

        SHA1

        d9604cf792e7178f410cb074fefd857d64c62ed8

        SHA256

        93bf38ba1f53ad1680bfce795ae7be1eef7f1037af19f7241200732e4ff17c24

        SHA512

        8f49696233992965bc5e6966a2f769dee23a5b85acfc24b3cb9bbd9c008fdfb9858ff9372ef25586b91a3352c26b45b84afbed4fb89c4275966ed57d163b83c3

      • memory/348-149-0x0000000000DA0000-0x0000000000DAA000-memory.dmp

        Filesize

        40KB

      • memory/544-193-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-205-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-158-0x00000000072B0000-0x00000000072C0000-memory.dmp

        Filesize

        64KB

      • memory/544-159-0x00000000072C0000-0x0000000007864000-memory.dmp

        Filesize

        5.6MB

      • memory/544-160-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-161-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-163-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-165-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-167-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-169-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-171-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-173-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-175-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-177-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-179-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-181-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-183-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-185-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-187-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-189-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-191-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-156-0x0000000002B90000-0x0000000002BDB000-memory.dmp

        Filesize

        300KB

      • memory/544-195-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-197-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-199-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-201-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-203-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-157-0x00000000072B0000-0x00000000072C0000-memory.dmp

        Filesize

        64KB

      • memory/544-207-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-209-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-211-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-213-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-215-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-217-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-219-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-221-0x0000000004BE0000-0x0000000004C1F000-memory.dmp

        Filesize

        252KB

      • memory/544-1066-0x0000000007870000-0x0000000007E88000-memory.dmp

        Filesize

        6.1MB

      • memory/544-1067-0x0000000007E90000-0x0000000007F9A000-memory.dmp

        Filesize

        1.0MB

      • memory/544-1068-0x0000000007280000-0x0000000007292000-memory.dmp

        Filesize

        72KB

      • memory/544-1070-0x0000000007FA0000-0x0000000007FDC000-memory.dmp

        Filesize

        240KB

      • memory/544-1069-0x00000000072B0000-0x00000000072C0000-memory.dmp

        Filesize

        64KB

      • memory/544-1073-0x0000000008280000-0x00000000082E6000-memory.dmp

        Filesize

        408KB

      • memory/544-1074-0x0000000008950000-0x00000000089E2000-memory.dmp

        Filesize

        584KB

      • memory/544-1075-0x0000000008A20000-0x0000000008A96000-memory.dmp

        Filesize

        472KB

      • memory/544-1076-0x0000000008AB0000-0x0000000008B00000-memory.dmp

        Filesize

        320KB

      • memory/544-1077-0x00000000072B0000-0x00000000072C0000-memory.dmp

        Filesize

        64KB

      • memory/544-1078-0x0000000008C20000-0x0000000008DE2000-memory.dmp

        Filesize

        1.8MB

      • memory/544-1079-0x0000000008E00000-0x000000000932C000-memory.dmp

        Filesize

        5.2MB

      • memory/544-1080-0x00000000072B0000-0x00000000072C0000-memory.dmp

        Filesize

        64KB

      • memory/1440-141-0x00000000048C0000-0x000000000494C000-memory.dmp

        Filesize

        560KB

      • memory/1440-150-0x0000000000400000-0x0000000002BE2000-memory.dmp

        Filesize

        39.9MB

      • memory/3552-1087-0x00000000005A0000-0x00000000005D2000-memory.dmp

        Filesize

        200KB

      • memory/3552-1088-0x0000000005200000-0x0000000005210000-memory.dmp

        Filesize

        64KB