Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/03/2023, 22:36

General

  • Target

    12e1eb5f3c7f829cb225d6b2c5aad4b8930bcb10319668135c017f338e8caf8d.exe

  • Size

    700KB

  • MD5

    b4e0c34a319e1fabf653c76d31563155

  • SHA1

    9819c9959249320ee6c94f97a59ea2eec9edfc70

  • SHA256

    12e1eb5f3c7f829cb225d6b2c5aad4b8930bcb10319668135c017f338e8caf8d

  • SHA512

    fc2b4a9e42cdaba670622bcf7fb635d3be29a41d7d2844c3b3b9d7be671f69778a3fbdb8af61a2f53e17da8ee44407202548b58cac11e71f39615c8260f9c6b5

  • SSDEEP

    12288:uMrZy908RhZJZ5nmxBC9DzxcAvp78F5eaXcTBen8JqVlYNthlTcaxY:fyzXrmxOR8zea208aghmX

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\12e1eb5f3c7f829cb225d6b2c5aad4b8930bcb10319668135c017f338e8caf8d.exe
    "C:\Users\Admin\AppData\Local\Temp\12e1eb5f3c7f829cb225d6b2c5aad4b8930bcb10319668135c017f338e8caf8d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3628
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384037.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384037.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4300
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7086.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7086.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4612
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6359.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6359.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3576
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si642781.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si642781.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4440

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si642781.exe

    Filesize

    175KB

    MD5

    629206192f00d7eaef07138db484e484

    SHA1

    9aeb5a02478ffc46e0150ca20be5d2a571d7f79a

    SHA256

    5fe85df74736d9d887ad082ec23079675a6d92795e0add3d747ccd1501858723

    SHA512

    0d25750263346cc2b5e98b67b734eaf2b9f176c8d6d1b16262e1d2376d1b4fe24c53aff4d7473bb829567e1b2732940fad26e192334c5ebf89cc5dbaa3985ff0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si642781.exe

    Filesize

    175KB

    MD5

    629206192f00d7eaef07138db484e484

    SHA1

    9aeb5a02478ffc46e0150ca20be5d2a571d7f79a

    SHA256

    5fe85df74736d9d887ad082ec23079675a6d92795e0add3d747ccd1501858723

    SHA512

    0d25750263346cc2b5e98b67b734eaf2b9f176c8d6d1b16262e1d2376d1b4fe24c53aff4d7473bb829567e1b2732940fad26e192334c5ebf89cc5dbaa3985ff0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384037.exe

    Filesize

    558KB

    MD5

    34091171a70cb14d7436ebe106c268de

    SHA1

    788690cbd4f242d6172910f6d6d0f3b26bbaa206

    SHA256

    fc8ae3566c54ecbc4d3e3bf2937fe76edf84131ebd5243043b8bbd2a2b3b2557

    SHA512

    ee7628aa258b060cad65fa01f46b5b51eb1a5e26f15db035a7fc04b04bd15413ffab5c4e2dba5559023bedd0a9818a46b0e401ae5a454e80903ceeffe77010ad

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un384037.exe

    Filesize

    558KB

    MD5

    34091171a70cb14d7436ebe106c268de

    SHA1

    788690cbd4f242d6172910f6d6d0f3b26bbaa206

    SHA256

    fc8ae3566c54ecbc4d3e3bf2937fe76edf84131ebd5243043b8bbd2a2b3b2557

    SHA512

    ee7628aa258b060cad65fa01f46b5b51eb1a5e26f15db035a7fc04b04bd15413ffab5c4e2dba5559023bedd0a9818a46b0e401ae5a454e80903ceeffe77010ad

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7086.exe

    Filesize

    307KB

    MD5

    307f6194c99f81b076596768ed18e95d

    SHA1

    aec42eba6ff9203deadd74c43bf0380012b33763

    SHA256

    ab2e6ae2bbcdf89457fdd3757e89d9c97db12c98c96fa6511fd035073accbcb8

    SHA512

    08fe4ed1ae8e863807138824a29fc20d93123fa6444dfdbefd67fb94ee2bb2411fa66cd8dbb9adbed3d6aa1ac67fede64db745dd7a518bf311227bfc102f62db

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro7086.exe

    Filesize

    307KB

    MD5

    307f6194c99f81b076596768ed18e95d

    SHA1

    aec42eba6ff9203deadd74c43bf0380012b33763

    SHA256

    ab2e6ae2bbcdf89457fdd3757e89d9c97db12c98c96fa6511fd035073accbcb8

    SHA512

    08fe4ed1ae8e863807138824a29fc20d93123fa6444dfdbefd67fb94ee2bb2411fa66cd8dbb9adbed3d6aa1ac67fede64db745dd7a518bf311227bfc102f62db

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6359.exe

    Filesize

    365KB

    MD5

    8a8670e2443f831fc610b840be361044

    SHA1

    1cc8ebbf4fe4f0849aa75685861674ffdab3dae6

    SHA256

    fa1774a44be81b0c59ce03aa1dbcbd9114c7ef5c18e572b3362dd91802fabb00

    SHA512

    ba9bf9ccb6f7514a98040c27afcb2af167864ba7c36846f2a4a9965369e6bdc6ea15765a0fa726e25ba340a4930439d16147f7a2d870c9bf01d1cc4d0594322e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6359.exe

    Filesize

    365KB

    MD5

    8a8670e2443f831fc610b840be361044

    SHA1

    1cc8ebbf4fe4f0849aa75685861674ffdab3dae6

    SHA256

    fa1774a44be81b0c59ce03aa1dbcbd9114c7ef5c18e572b3362dd91802fabb00

    SHA512

    ba9bf9ccb6f7514a98040c27afcb2af167864ba7c36846f2a4a9965369e6bdc6ea15765a0fa726e25ba340a4930439d16147f7a2d870c9bf01d1cc4d0594322e

  • memory/3576-1092-0x0000000005980000-0x0000000005F86000-memory.dmp

    Filesize

    6.0MB

  • memory/3576-1093-0x00000000053F0000-0x00000000054FA000-memory.dmp

    Filesize

    1.0MB

  • memory/3576-209-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-208-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-197-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-1108-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-195-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-1107-0x0000000006AF0000-0x000000000701C000-memory.dmp

    Filesize

    5.2MB

  • memory/3576-1106-0x0000000006920000-0x0000000006AE2000-memory.dmp

    Filesize

    1.8MB

  • memory/3576-199-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-1105-0x00000000068A0000-0x00000000068F0000-memory.dmp

    Filesize

    320KB

  • memory/3576-1104-0x0000000006820000-0x0000000006896000-memory.dmp

    Filesize

    472KB

  • memory/3576-1103-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-1102-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-1101-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-1099-0x0000000006500000-0x0000000006592000-memory.dmp

    Filesize

    584KB

  • memory/3576-1098-0x0000000005830000-0x0000000005896000-memory.dmp

    Filesize

    408KB

  • memory/3576-1097-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-1096-0x00000000056A0000-0x00000000056EB000-memory.dmp

    Filesize

    300KB

  • memory/3576-1095-0x0000000005650000-0x000000000568E000-memory.dmp

    Filesize

    248KB

  • memory/3576-1094-0x0000000005530000-0x0000000005542000-memory.dmp

    Filesize

    72KB

  • memory/3576-206-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/3576-219-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-217-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-215-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-180-0x0000000004C40000-0x0000000004C86000-memory.dmp

    Filesize

    280KB

  • memory/3576-181-0x0000000004CC0000-0x0000000004D04000-memory.dmp

    Filesize

    272KB

  • memory/3576-182-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-183-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-185-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-187-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-189-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-191-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-193-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-213-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-201-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-211-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-202-0x0000000000720000-0x000000000076B000-memory.dmp

    Filesize

    300KB

  • memory/3576-205-0x0000000004CC0000-0x0000000004CFF000-memory.dmp

    Filesize

    252KB

  • memory/3576-204-0x0000000004D10000-0x0000000004D20000-memory.dmp

    Filesize

    64KB

  • memory/4440-1114-0x0000000000B10000-0x0000000000B42000-memory.dmp

    Filesize

    200KB

  • memory/4440-1115-0x0000000005730000-0x0000000005740000-memory.dmp

    Filesize

    64KB

  • memory/4440-1116-0x0000000005550000-0x000000000559B000-memory.dmp

    Filesize

    300KB

  • memory/4612-170-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4612-153-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-147-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-138-0x0000000000710000-0x000000000073D000-memory.dmp

    Filesize

    180KB

  • memory/4612-139-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/4612-175-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4612-137-0x00000000026E0000-0x00000000026F8000-memory.dmp

    Filesize

    96KB

  • memory/4612-173-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/4612-172-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/4612-171-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/4612-140-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB

  • memory/4612-169-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-167-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-165-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-163-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-161-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-159-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-157-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-155-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-151-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-149-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-145-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-136-0x0000000004F20000-0x000000000541E000-memory.dmp

    Filesize

    5.0MB

  • memory/4612-135-0x0000000002270000-0x000000000228A000-memory.dmp

    Filesize

    104KB

  • memory/4612-143-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-142-0x00000000026E0000-0x00000000026F2000-memory.dmp

    Filesize

    72KB

  • memory/4612-141-0x0000000004F10000-0x0000000004F20000-memory.dmp

    Filesize

    64KB