Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • max time network
    72s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/03/2023, 14:26

General

  • Target

    274dbd160c52099b971d7de3d1ffb6ade75774e385d50e817bfb704c05ac8e2a.exe

  • Size

    687KB

  • MD5

    f7087c0a042e4fb42e7a6d3192f31a2a

  • SHA1

    5661cb48aa55e07ca7d1e260f4b8e398c19db45a

  • SHA256

    274dbd160c52099b971d7de3d1ffb6ade75774e385d50e817bfb704c05ac8e2a

  • SHA512

    345ff6275064daea7425cbaeb6f3af449df1145b91aa035907dc6628aad9ad25fccc103faa70a929ec140bb2b177860966a445d60a014f30e368f8cff687c79f

  • SSDEEP

    12288:mMr0y903lzpxDKApG5ER7yErabo0av0bqKsHTJwkask:Oyk9DFpGsgbDBbSwk/k

Malware Config

Extracted

Family

redline

Botnet

boris

C2

193.233.20.32:4125

Attributes
  • auth_value

    766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

firmu

C2

193.233.20.32:4125

Attributes
  • auth_value

    9f3e5e35e4a3a38fc36c5a851728aa33

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\274dbd160c52099b971d7de3d1ffb6ade75774e385d50e817bfb704c05ac8e2a.exe
    "C:\Users\Admin\AppData\Local\Temp\274dbd160c52099b971d7de3d1ffb6ade75774e385d50e817bfb704c05ac8e2a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977679.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977679.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4156
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0837.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0837.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:996
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9785.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9785.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4332
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368618.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368618.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4952

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368618.exe

    Filesize

    175KB

    MD5

    6b780eb9c71d7b15142e05f33765678b

    SHA1

    1b853b28e715a7c7a8e4a39567e7b22697265741

    SHA256

    2067ab13d0198979bf52e0b0e37bc9187cb178517620826424fc3c9f41c06d76

    SHA512

    a149005b933b4a7739cf723ee1fec219e8eb2019fbe5300a807383aae83c46e60d0fcd8f3b1f5cb8d85556ade4567db91ecdaa4fdbbc87350d5cb7b1f4274314

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si368618.exe

    Filesize

    175KB

    MD5

    6b780eb9c71d7b15142e05f33765678b

    SHA1

    1b853b28e715a7c7a8e4a39567e7b22697265741

    SHA256

    2067ab13d0198979bf52e0b0e37bc9187cb178517620826424fc3c9f41c06d76

    SHA512

    a149005b933b4a7739cf723ee1fec219e8eb2019fbe5300a807383aae83c46e60d0fcd8f3b1f5cb8d85556ade4567db91ecdaa4fdbbc87350d5cb7b1f4274314

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977679.exe

    Filesize

    545KB

    MD5

    6117cce83f6d2374070b28bffde98787

    SHA1

    f0f9b1b6f1f43f679529de6ef7f78d8948a259f6

    SHA256

    b82f70ad085751fd68d933c272d98f82b7d5ee7d090b8ef1184930cff4f5fdb6

    SHA512

    14788178b6a56485c50d4aba468cc63c34fceb50c5876cfbc349ba0c359fc6c3ae55642ba5f98e14392ab899d5e996953ab9882cb9285217c1962d4834ab3c13

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un977679.exe

    Filesize

    545KB

    MD5

    6117cce83f6d2374070b28bffde98787

    SHA1

    f0f9b1b6f1f43f679529de6ef7f78d8948a259f6

    SHA256

    b82f70ad085751fd68d933c272d98f82b7d5ee7d090b8ef1184930cff4f5fdb6

    SHA512

    14788178b6a56485c50d4aba468cc63c34fceb50c5876cfbc349ba0c359fc6c3ae55642ba5f98e14392ab899d5e996953ab9882cb9285217c1962d4834ab3c13

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0837.exe

    Filesize

    325KB

    MD5

    565eba1e4f9eee5d84ea3facc4f35b73

    SHA1

    fc4896f627b040c5780b254d3baa508fed70bf47

    SHA256

    f9dec88bbd9030b62491bb189a106161864a69bd9e42340c9f66587bd0010708

    SHA512

    c58bcde07c521d204f7a9509f7e1676c09f2e3519edacd04bde40d4c102275a0265793a615e779d69237d4a6cc4472216ef588e1bd89f4a4844963f534ebb6db

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0837.exe

    Filesize

    325KB

    MD5

    565eba1e4f9eee5d84ea3facc4f35b73

    SHA1

    fc4896f627b040c5780b254d3baa508fed70bf47

    SHA256

    f9dec88bbd9030b62491bb189a106161864a69bd9e42340c9f66587bd0010708

    SHA512

    c58bcde07c521d204f7a9509f7e1676c09f2e3519edacd04bde40d4c102275a0265793a615e779d69237d4a6cc4472216ef588e1bd89f4a4844963f534ebb6db

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9785.exe

    Filesize

    382KB

    MD5

    6abccdd9692189341c649c9d8a80eb66

    SHA1

    7f10dee90e98e773688ead96cc54920aceb46211

    SHA256

    c6fcb4c9bf245a7b43dd67b786805f603d5ef33aa3a99a4a8dc017758fe29a27

    SHA512

    e1c4151617fe530bdeace3d3bb9bc0f39c608b03a09d6eebb7a4da6a7da1bde00457a66dfeecb949f790bccf80ea6932faefcd17048a6e08a6db94e18f76f848

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9785.exe

    Filesize

    382KB

    MD5

    6abccdd9692189341c649c9d8a80eb66

    SHA1

    7f10dee90e98e773688ead96cc54920aceb46211

    SHA256

    c6fcb4c9bf245a7b43dd67b786805f603d5ef33aa3a99a4a8dc017758fe29a27

    SHA512

    e1c4151617fe530bdeace3d3bb9bc0f39c608b03a09d6eebb7a4da6a7da1bde00457a66dfeecb949f790bccf80ea6932faefcd17048a6e08a6db94e18f76f848

  • memory/996-134-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/996-135-0x0000000004B10000-0x0000000004B2A000-memory.dmp

    Filesize

    104KB

  • memory/996-136-0x00000000071F0000-0x00000000076EE000-memory.dmp

    Filesize

    5.0MB

  • memory/996-137-0x00000000070A0000-0x00000000070B8000-memory.dmp

    Filesize

    96KB

  • memory/996-138-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-140-0x00000000071E0000-0x00000000071F0000-memory.dmp

    Filesize

    64KB

  • memory/996-139-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-144-0x00000000071E0000-0x00000000071F0000-memory.dmp

    Filesize

    64KB

  • memory/996-146-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-143-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-142-0x00000000071E0000-0x00000000071F0000-memory.dmp

    Filesize

    64KB

  • memory/996-148-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-150-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-152-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-154-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-156-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-158-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-160-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-162-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-164-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-166-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-168-0x00000000070A0000-0x00000000070B2000-memory.dmp

    Filesize

    72KB

  • memory/996-169-0x0000000000400000-0x0000000002B7E000-memory.dmp

    Filesize

    39.5MB

  • memory/996-172-0x00000000071E0000-0x00000000071F0000-memory.dmp

    Filesize

    64KB

  • memory/996-173-0x00000000071E0000-0x00000000071F0000-memory.dmp

    Filesize

    64KB

  • memory/996-171-0x0000000000400000-0x0000000002B7E000-memory.dmp

    Filesize

    39.5MB

  • memory/4332-178-0x00000000047F0000-0x0000000004836000-memory.dmp

    Filesize

    280KB

  • memory/4332-179-0x0000000007640000-0x0000000007684000-memory.dmp

    Filesize

    272KB

  • memory/4332-180-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-183-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-181-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-185-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-187-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-189-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-192-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-191-0x0000000002D90000-0x0000000002DDB000-memory.dmp

    Filesize

    300KB

  • memory/4332-193-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-196-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-195-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-198-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-201-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-199-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-205-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-203-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-207-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-209-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-211-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-213-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-215-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-217-0x0000000007640000-0x000000000767F000-memory.dmp

    Filesize

    252KB

  • memory/4332-1090-0x0000000007DF0000-0x00000000083F6000-memory.dmp

    Filesize

    6.0MB

  • memory/4332-1091-0x0000000007860000-0x000000000796A000-memory.dmp

    Filesize

    1.0MB

  • memory/4332-1092-0x00000000079A0000-0x00000000079B2000-memory.dmp

    Filesize

    72KB

  • memory/4332-1093-0x00000000079C0000-0x00000000079FE000-memory.dmp

    Filesize

    248KB

  • memory/4332-1094-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-1095-0x0000000007B10000-0x0000000007B5B000-memory.dmp

    Filesize

    300KB

  • memory/4332-1097-0x0000000007CA0000-0x0000000007D06000-memory.dmp

    Filesize

    408KB

  • memory/4332-1099-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-1098-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-1100-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-1101-0x0000000008980000-0x0000000008A12000-memory.dmp

    Filesize

    584KB

  • memory/4332-1102-0x0000000008A60000-0x0000000008C22000-memory.dmp

    Filesize

    1.8MB

  • memory/4332-1103-0x0000000008C30000-0x000000000915C000-memory.dmp

    Filesize

    5.2MB

  • memory/4332-1104-0x0000000007130000-0x0000000007140000-memory.dmp

    Filesize

    64KB

  • memory/4332-1105-0x00000000094C0000-0x0000000009536000-memory.dmp

    Filesize

    472KB

  • memory/4332-1106-0x0000000009550000-0x00000000095A0000-memory.dmp

    Filesize

    320KB

  • memory/4952-1112-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

    Filesize

    200KB

  • memory/4952-1113-0x00000000057C0000-0x000000000580B000-memory.dmp

    Filesize

    300KB

  • memory/4952-1114-0x0000000005A80000-0x0000000005A90000-memory.dmp

    Filesize

    64KB