Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    59s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    27/03/2023, 13:19

General

  • Target

    c25eb70130443c9e6fbf331cff5924ffc6035ff7cacfcf8daf4e4c19e5f45491.exe

  • Size

    685KB

  • MD5

    ae7bdd17d4b6c0e0ebe954d915c43319

  • SHA1

    61799aff793b9a5f426f6569683dab378f5767e4

  • SHA256

    c25eb70130443c9e6fbf331cff5924ffc6035ff7cacfcf8daf4e4c19e5f45491

  • SHA512

    368f8fd260c34cebe947cd27dcb45eed54334cf4b29de1f798e968edb4e90d0a02e887cd81cac128e92c6b0be137808d5e212f1b7877b9f9d541326059944f15

  • SSDEEP

    12288:fMrIy90l6Y4XJzkuvspWeV5Jhz7+yHVI2s6YsdbQrlpCb87BdesEFxL8/ktDJ:jy2v4JLvspxLJ71CsbQrLQcTesEvLHt9

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c25eb70130443c9e6fbf331cff5924ffc6035ff7cacfcf8daf4e4c19e5f45491.exe
    "C:\Users\Admin\AppData\Local\Temp\c25eb70130443c9e6fbf331cff5924ffc6035ff7cacfcf8daf4e4c19e5f45491.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3228
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un266966.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un266966.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3316
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5374.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5374.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2772
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8944.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8944.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1356
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si996440.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si996440.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3732

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si996440.exe

    Filesize

    175KB

    MD5

    6d305a7fdd16f9f3e85df92ba3b73ac2

    SHA1

    51dc1f03a9896ffdf894ba142f884c9eabefcb94

    SHA256

    dc8cc04c51416cd5d365288dfac22bf18d3ac043f31d0a75c5b10e21d0610f7c

    SHA512

    c58a63ecba6d185a3eb5cc4143bf7b27163c392998f647c378229bc7c3ac8848ee2f3ae8dab5900ca0df722981515a5dc3b50a4e45649f5444449249b9fe438b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si996440.exe

    Filesize

    175KB

    MD5

    6d305a7fdd16f9f3e85df92ba3b73ac2

    SHA1

    51dc1f03a9896ffdf894ba142f884c9eabefcb94

    SHA256

    dc8cc04c51416cd5d365288dfac22bf18d3ac043f31d0a75c5b10e21d0610f7c

    SHA512

    c58a63ecba6d185a3eb5cc4143bf7b27163c392998f647c378229bc7c3ac8848ee2f3ae8dab5900ca0df722981515a5dc3b50a4e45649f5444449249b9fe438b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un266966.exe

    Filesize

    543KB

    MD5

    b7f008b9a0f62d745f8593f418f4e891

    SHA1

    fcda02815cd343b46c493e3b2645b0d59cf79745

    SHA256

    d172b05f8c2c8df1742318009928402f7278ca0476de8fc7f8a5c243a70f3ace

    SHA512

    19e73d3e47e835cce31289e3e5be0e3d2f5357bad0d36e0a3b949b2545d27099f3b4611658983f4607480a0b1aec75ea28922c7d99ed15f6985abb16562076dd

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un266966.exe

    Filesize

    543KB

    MD5

    b7f008b9a0f62d745f8593f418f4e891

    SHA1

    fcda02815cd343b46c493e3b2645b0d59cf79745

    SHA256

    d172b05f8c2c8df1742318009928402f7278ca0476de8fc7f8a5c243a70f3ace

    SHA512

    19e73d3e47e835cce31289e3e5be0e3d2f5357bad0d36e0a3b949b2545d27099f3b4611658983f4607480a0b1aec75ea28922c7d99ed15f6985abb16562076dd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5374.exe

    Filesize

    292KB

    MD5

    19a1982454387cfb02c0c89e1d80f9fe

    SHA1

    8a67e3aed0a1756e656465c2dc94e91089cb01ac

    SHA256

    3013e9266d5d26cc835a6612cd91e52769fc7020548431ab9d8e92e2fcfbf434

    SHA512

    bf394e14415f2992b12ba0d39045aad37035aced16b045a6490204a28da9cecb4a24481847cad8587c40a9d08562ccde95a53dc5540a1a0255c11edc209e07b1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5374.exe

    Filesize

    292KB

    MD5

    19a1982454387cfb02c0c89e1d80f9fe

    SHA1

    8a67e3aed0a1756e656465c2dc94e91089cb01ac

    SHA256

    3013e9266d5d26cc835a6612cd91e52769fc7020548431ab9d8e92e2fcfbf434

    SHA512

    bf394e14415f2992b12ba0d39045aad37035aced16b045a6490204a28da9cecb4a24481847cad8587c40a9d08562ccde95a53dc5540a1a0255c11edc209e07b1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8944.exe

    Filesize

    350KB

    MD5

    7fa0fa4683fcf4826897f24fab79ef90

    SHA1

    313e8792c9b980da1a4e0153ea62c7c50b7eb16e

    SHA256

    08d633d9021e1f8d39a9095f15df65693c98fa6c3e1f239a48ae46ea2a24456a

    SHA512

    e9ebc5e116098d94879770bcb3fd767a57cf72a6e3e7428930e0787701ec81761f7985192c416ba7ed22c144bfe9d5a5e590caa28a61a0874fb2351e83a21fda

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8944.exe

    Filesize

    350KB

    MD5

    7fa0fa4683fcf4826897f24fab79ef90

    SHA1

    313e8792c9b980da1a4e0153ea62c7c50b7eb16e

    SHA256

    08d633d9021e1f8d39a9095f15df65693c98fa6c3e1f239a48ae46ea2a24456a

    SHA512

    e9ebc5e116098d94879770bcb3fd767a57cf72a6e3e7428930e0787701ec81761f7985192c416ba7ed22c144bfe9d5a5e590caa28a61a0874fb2351e83a21fda

  • memory/1356-1090-0x00000000052B0000-0x00000000053BA000-memory.dmp

    Filesize

    1.0MB

  • memory/1356-1093-0x0000000005410000-0x000000000544E000-memory.dmp

    Filesize

    248KB

  • memory/1356-192-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-1105-0x00000000069B0000-0x0000000006EDC000-memory.dmp

    Filesize

    5.2MB

  • memory/1356-1104-0x00000000067E0000-0x00000000069A2000-memory.dmp

    Filesize

    1.8MB

  • memory/1356-1103-0x0000000006670000-0x00000000066C0000-memory.dmp

    Filesize

    320KB

  • memory/1356-1102-0x00000000065E0000-0x0000000006656000-memory.dmp

    Filesize

    472KB

  • memory/1356-1101-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-1100-0x00000000063D0000-0x0000000006462000-memory.dmp

    Filesize

    584KB

  • memory/1356-1099-0x00000000056F0000-0x0000000005756000-memory.dmp

    Filesize

    408KB

  • memory/1356-1098-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-1097-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-1096-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-1094-0x0000000005560000-0x00000000055AB000-memory.dmp

    Filesize

    300KB

  • memory/1356-1092-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-1091-0x00000000053F0000-0x0000000005402000-memory.dmp

    Filesize

    72KB

  • memory/1356-1089-0x0000000005840000-0x0000000005E46000-memory.dmp

    Filesize

    6.0MB

  • memory/1356-216-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-214-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-212-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-194-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-177-0x0000000002510000-0x0000000002556000-memory.dmp

    Filesize

    280KB

  • memory/1356-178-0x00000000051B0000-0x00000000051F4000-memory.dmp

    Filesize

    272KB

  • memory/1356-179-0x00000000007F0000-0x000000000083B000-memory.dmp

    Filesize

    300KB

  • memory/1356-181-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-182-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-183-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-180-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-184-0x0000000000950000-0x0000000000960000-memory.dmp

    Filesize

    64KB

  • memory/1356-188-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-190-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-186-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-208-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-196-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-210-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-198-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-200-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-202-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-204-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/1356-206-0x00000000051B0000-0x00000000051EE000-memory.dmp

    Filesize

    248KB

  • memory/2772-147-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-136-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/2772-140-0x0000000004E70000-0x000000000536E000-memory.dmp

    Filesize

    5.0MB

  • memory/2772-172-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/2772-170-0x0000000000400000-0x000000000070C000-memory.dmp

    Filesize

    3.0MB

  • memory/2772-169-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-138-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2772-167-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-165-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-141-0x00000000028F0000-0x0000000002908000-memory.dmp

    Filesize

    96KB

  • memory/2772-157-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-142-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-139-0x0000000004E60000-0x0000000004E70000-memory.dmp

    Filesize

    64KB

  • memory/2772-159-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-161-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-153-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-151-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-149-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-155-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-145-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-143-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/2772-137-0x0000000002280000-0x000000000229A000-memory.dmp

    Filesize

    104KB

  • memory/2772-163-0x00000000028F0000-0x0000000002902000-memory.dmp

    Filesize

    72KB

  • memory/3732-1111-0x0000000000B30000-0x0000000000B62000-memory.dmp

    Filesize

    200KB

  • memory/3732-1112-0x0000000005450000-0x0000000005460000-memory.dmp

    Filesize

    64KB

  • memory/3732-1113-0x0000000005570000-0x00000000055BB000-memory.dmp

    Filesize

    300KB