Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    57s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/03/2023, 21:56

General

  • Target

    a872764a700579ffa144a57d135e39bc393e640a78dcc3f9b9d0f1abfcf42674.exe

  • Size

    700KB

  • MD5

    146262f23a06557ae09f1dca37613818

  • SHA1

    e1e6163829a2cb18088663b9a3fe02a0572c6426

  • SHA256

    a872764a700579ffa144a57d135e39bc393e640a78dcc3f9b9d0f1abfcf42674

  • SHA512

    6fa7832d98b16e76908a6d9e67f3b3f98268150391edbea3e1087ee0f538486197ba27c25dcc6abad4f9b84e44f1794893a59086bda0f0eaa04233b8b507bb27

  • SSDEEP

    12288:sMrly90wBiOJtu3h+e6imVJPKh9DMCcAD9u8F3xp2EPWUBg6quj4XV13FVTRBauM:ZytBiOJa+QmDPQD9u8VHNDgnuj4XVB2B

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a872764a700579ffa144a57d135e39bc393e640a78dcc3f9b9d0f1abfcf42674.exe
    "C:\Users\Admin\AppData\Local\Temp\a872764a700579ffa144a57d135e39bc393e640a78dcc3f9b9d0f1abfcf42674.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un197226.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un197226.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0210.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0210.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4236
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9696.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9696.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3620
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si857493.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si857493.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2076

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si857493.exe

    Filesize

    175KB

    MD5

    25c36cb8426ab590c762a26ba0f89937

    SHA1

    d02a81a7fbd8212b99dfe0f53e1276d226a7d689

    SHA256

    11cfcbddae18b087d2cf8d5b8b87868bca19faabb6631f1a1db1d6b9b3ea003f

    SHA512

    8da8cc6abd485359c91eba81131335ae9be06abe6f0827ef0b8059805744d37d772fcd369cc399b9322ff852939f103f5ee55dcf032f818573f856fbfcc390c4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si857493.exe

    Filesize

    175KB

    MD5

    25c36cb8426ab590c762a26ba0f89937

    SHA1

    d02a81a7fbd8212b99dfe0f53e1276d226a7d689

    SHA256

    11cfcbddae18b087d2cf8d5b8b87868bca19faabb6631f1a1db1d6b9b3ea003f

    SHA512

    8da8cc6abd485359c91eba81131335ae9be06abe6f0827ef0b8059805744d37d772fcd369cc399b9322ff852939f103f5ee55dcf032f818573f856fbfcc390c4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un197226.exe

    Filesize

    558KB

    MD5

    e8385998fe627870583fec2c517e94cd

    SHA1

    4b718bbc7d881495cc0f2fa0070bd0a1d3d18723

    SHA256

    4a13c9a66f1bd351ede3ab3d3ccf7b5551364c694db552c3464ed9e1568acd68

    SHA512

    cae6847424e9d81946a6181f4bc1d23fbb95482ed228eaf1035767c653a4af4fb427575e45dc7c107cd79e60a48ae92b5e3418f8a4221e326660585b3ead155d

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un197226.exe

    Filesize

    558KB

    MD5

    e8385998fe627870583fec2c517e94cd

    SHA1

    4b718bbc7d881495cc0f2fa0070bd0a1d3d18723

    SHA256

    4a13c9a66f1bd351ede3ab3d3ccf7b5551364c694db552c3464ed9e1568acd68

    SHA512

    cae6847424e9d81946a6181f4bc1d23fbb95482ed228eaf1035767c653a4af4fb427575e45dc7c107cd79e60a48ae92b5e3418f8a4221e326660585b3ead155d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0210.exe

    Filesize

    307KB

    MD5

    8779ce2b098ba94fcac91afdd1b9b69c

    SHA1

    045b48ae179a35f2198ad993827ddd2b9bd0634b

    SHA256

    193fca9ed4b573945156ec412e52ca7a1354646ea965b03e8923ae469e0e0e18

    SHA512

    d81234e05aec1d448fc4fadfcc8560c2de143c2223b011b4eba1c5484e514a89ece524c4978ecab2c98eb338035e34ba4b390a408fd37e61b986d72f154948fb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0210.exe

    Filesize

    307KB

    MD5

    8779ce2b098ba94fcac91afdd1b9b69c

    SHA1

    045b48ae179a35f2198ad993827ddd2b9bd0634b

    SHA256

    193fca9ed4b573945156ec412e52ca7a1354646ea965b03e8923ae469e0e0e18

    SHA512

    d81234e05aec1d448fc4fadfcc8560c2de143c2223b011b4eba1c5484e514a89ece524c4978ecab2c98eb338035e34ba4b390a408fd37e61b986d72f154948fb

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9696.exe

    Filesize

    365KB

    MD5

    8250ff2e52d765024745daad3b8c8153

    SHA1

    20b1552ff816e233d2243f8f5acbe110f72b50f4

    SHA256

    1c9c43ed39ec2199acb72508434db3c1a9b9af7b0ff2c9392be5fc4f69720d8a

    SHA512

    d8e39359a92905c53dd9fd9643eb9b262f5c16b2b89e27d1b887945fc3da24428d04a5ffdfa6600ec2ad11d7c46b7af036ebea69a93f8c76d7bd89f05b652d9d

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9696.exe

    Filesize

    365KB

    MD5

    8250ff2e52d765024745daad3b8c8153

    SHA1

    20b1552ff816e233d2243f8f5acbe110f72b50f4

    SHA256

    1c9c43ed39ec2199acb72508434db3c1a9b9af7b0ff2c9392be5fc4f69720d8a

    SHA512

    d8e39359a92905c53dd9fd9643eb9b262f5c16b2b89e27d1b887945fc3da24428d04a5ffdfa6600ec2ad11d7c46b7af036ebea69a93f8c76d7bd89f05b652d9d

  • memory/2076-1118-0x00000000057F0000-0x0000000005800000-memory.dmp

    Filesize

    64KB

  • memory/2076-1117-0x00000000059D0000-0x0000000005A1B000-memory.dmp

    Filesize

    300KB

  • memory/2076-1116-0x0000000000F90000-0x0000000000FC2000-memory.dmp

    Filesize

    200KB

  • memory/3620-1093-0x00000000059F0000-0x0000000005FF6000-memory.dmp

    Filesize

    6.0MB

  • memory/3620-1096-0x0000000005410000-0x000000000544E000-memory.dmp

    Filesize

    248KB

  • memory/3620-1110-0x0000000006FC0000-0x0000000007010000-memory.dmp

    Filesize

    320KB

  • memory/3620-1109-0x0000000006F40000-0x0000000006FB6000-memory.dmp

    Filesize

    472KB

  • memory/3620-1107-0x00000000068D0000-0x0000000006DFC000-memory.dmp

    Filesize

    5.2MB

  • memory/3620-1106-0x00000000066E0000-0x00000000068A2000-memory.dmp

    Filesize

    1.8MB

  • memory/3620-1105-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-1104-0x0000000005790000-0x00000000057F6000-memory.dmp

    Filesize

    408KB

  • memory/3620-1103-0x00000000056F0000-0x0000000005782000-memory.dmp

    Filesize

    584KB

  • memory/3620-1102-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-1101-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-1100-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-1098-0x0000000005560000-0x00000000055AB000-memory.dmp

    Filesize

    300KB

  • memory/3620-1097-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-1095-0x00000000053F0000-0x0000000005402000-memory.dmp

    Filesize

    72KB

  • memory/3620-1094-0x0000000004DA0000-0x0000000004EAA000-memory.dmp

    Filesize

    1.0MB

  • memory/3620-222-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-224-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-220-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

    Filesize

    64KB

  • memory/3620-219-0x0000000000890000-0x00000000008DB000-memory.dmp

    Filesize

    300KB

  • memory/3620-216-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-214-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-181-0x0000000002490000-0x00000000024D6000-memory.dmp

    Filesize

    280KB

  • memory/3620-182-0x0000000002890000-0x00000000028D4000-memory.dmp

    Filesize

    272KB

  • memory/3620-183-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-184-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-186-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-188-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-190-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-192-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-194-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-196-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-198-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-200-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-202-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-204-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-206-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-208-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-210-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/3620-212-0x0000000002890000-0x00000000028CF000-memory.dmp

    Filesize

    252KB

  • memory/4236-164-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-138-0x0000000004EF0000-0x00000000053EE000-memory.dmp

    Filesize

    5.0MB

  • memory/4236-176-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4236-174-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4236-173-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4236-172-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4236-141-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4236-171-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4236-170-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-144-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-168-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-160-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-143-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-142-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4236-166-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-158-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-156-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-154-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-152-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-150-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-148-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-146-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-140-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4236-139-0x00000000026E0000-0x00000000026F8000-memory.dmp

    Filesize

    96KB

  • memory/4236-162-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4236-137-0x0000000002290000-0x00000000022AA000-memory.dmp

    Filesize

    104KB

  • memory/4236-136-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB