Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 14:01

General

  • Target

    bc08bc16079377cb680501f5eb0d1fb7975fa3b3b8a4bf89fc7cbfa630ea37bc.exe

  • Size

    685KB

  • MD5

    fb2cec08b9d6dfb1beda8c3eecd3b8ee

  • SHA1

    efaac52239241dba579215a5887b2e73eae8c5cd

  • SHA256

    bc08bc16079377cb680501f5eb0d1fb7975fa3b3b8a4bf89fc7cbfa630ea37bc

  • SHA512

    600ef887e8395805f364ec6c922c932d7dc933fcec1832b735ac27ca31d84a009b53669e89471875de88b0b27aef3baacab309f4ce158ec9904a13916247050e

  • SSDEEP

    12288:iMray90o0aJDnB9VYnoWxGW2GN3FQPAPSWs8AITgoJv7BDMqEoJAvIPyWDW:ky5BEnoWI6QVWsZIMuNMqEo5PyWDW

Malware Config

Extracted

Family

redline

Botnet

sony

C2

193.233.20.33:4125

Attributes
  • auth_value

    1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

nice

C2

193.233.20.33:4125

Attributes
  • auth_value

    a7371b75699e8bc7c51fb960e8ac9e81

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc08bc16079377cb680501f5eb0d1fb7975fa3b3b8a4bf89fc7cbfa630ea37bc.exe
    "C:\Users\Admin\AppData\Local\Temp\bc08bc16079377cb680501f5eb0d1fb7975fa3b3b8a4bf89fc7cbfa630ea37bc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un282958.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un282958.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8765.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8765.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3488
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 1084
          4⤵
          • Program crash
          PID:1324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6039.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6039.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3144
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 1844
          4⤵
          • Program crash
          PID:3744
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253004.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253004.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3232
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3488 -ip 3488
    1⤵
      PID:5012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3144 -ip 3144
      1⤵
        PID:4396

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253004.exe

        Filesize

        175KB

        MD5

        ea9911a1e2f677364741da9033e090b0

        SHA1

        f5a2e8c6fc003e26d42691b404afd424843dc545

        SHA256

        c7a484564fadf263d6450184b60c252726373c20322e362a737e01f59ad4f2eb

        SHA512

        207fa32a30ae65db9cba0e9bc49cb133af10a4b5df98a5bf37a603e3a7f60511e0964be4e7e98e627668010fb6f729d9365c5b9d8252662e1a9a5ab99490cb3f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si253004.exe

        Filesize

        175KB

        MD5

        ea9911a1e2f677364741da9033e090b0

        SHA1

        f5a2e8c6fc003e26d42691b404afd424843dc545

        SHA256

        c7a484564fadf263d6450184b60c252726373c20322e362a737e01f59ad4f2eb

        SHA512

        207fa32a30ae65db9cba0e9bc49cb133af10a4b5df98a5bf37a603e3a7f60511e0964be4e7e98e627668010fb6f729d9365c5b9d8252662e1a9a5ab99490cb3f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un282958.exe

        Filesize

        543KB

        MD5

        3324965a10a44d7621327fabeea5a703

        SHA1

        049f8980eac2364da0bd4bb66464d19b6b6071ed

        SHA256

        85dff5031a904655832362fa9f3f059c95c258eabe6b68578479332fe65b0f02

        SHA512

        43d83250086ecd87dd2cf0559bcdc11bd2167a973ee140c72762e26a4dc632d35433f0eb7a2994a42332226cbb8f5e35edf2a4211d45196718a8e0b258f9d653

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un282958.exe

        Filesize

        543KB

        MD5

        3324965a10a44d7621327fabeea5a703

        SHA1

        049f8980eac2364da0bd4bb66464d19b6b6071ed

        SHA256

        85dff5031a904655832362fa9f3f059c95c258eabe6b68578479332fe65b0f02

        SHA512

        43d83250086ecd87dd2cf0559bcdc11bd2167a973ee140c72762e26a4dc632d35433f0eb7a2994a42332226cbb8f5e35edf2a4211d45196718a8e0b258f9d653

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8765.exe

        Filesize

        292KB

        MD5

        c2164bcfe464d1ea2a99aa07fc08b4b0

        SHA1

        961ebffdb232a4b3eadc68ba07c34b66c69da64a

        SHA256

        237438762dab856b47742eec356ba58003b5df43a2cbe3adebaad2ddb93c7fe9

        SHA512

        44ed2a8be088d4b524b031c4fdbbfaa50b21f9c35557ce1b2ef7658f89250345390dff28679371e28360cfc4daf4931f900ac858b48dc21fa74daef0a3f0a844

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro8765.exe

        Filesize

        292KB

        MD5

        c2164bcfe464d1ea2a99aa07fc08b4b0

        SHA1

        961ebffdb232a4b3eadc68ba07c34b66c69da64a

        SHA256

        237438762dab856b47742eec356ba58003b5df43a2cbe3adebaad2ddb93c7fe9

        SHA512

        44ed2a8be088d4b524b031c4fdbbfaa50b21f9c35557ce1b2ef7658f89250345390dff28679371e28360cfc4daf4931f900ac858b48dc21fa74daef0a3f0a844

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6039.exe

        Filesize

        350KB

        MD5

        ae1373fdc423c3c07e5ad6fdc63cfea7

        SHA1

        b26f3847f086db4671eef2dfbad914d28c7e5bae

        SHA256

        1621b3a6d43bf190bc38d8f73e9e4d5379b2152b686b8fd45f9352af0fc3cf24

        SHA512

        f5c7587d1b3e3579807760ceb6add0cbe9893140041999ae8d37b7b002c7714d020260ff7ba95577ba0a1c211dd0262e91bd2f079838fe37fed8a4aa1b94c47b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6039.exe

        Filesize

        350KB

        MD5

        ae1373fdc423c3c07e5ad6fdc63cfea7

        SHA1

        b26f3847f086db4671eef2dfbad914d28c7e5bae

        SHA256

        1621b3a6d43bf190bc38d8f73e9e4d5379b2152b686b8fd45f9352af0fc3cf24

        SHA512

        f5c7587d1b3e3579807760ceb6add0cbe9893140041999ae8d37b7b002c7714d020260ff7ba95577ba0a1c211dd0262e91bd2f079838fe37fed8a4aa1b94c47b

      • memory/3144-1099-0x0000000005480000-0x0000000005A98000-memory.dmp

        Filesize

        6.1MB

      • memory/3144-1102-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/3144-1114-0x0000000007360000-0x00000000073B0000-memory.dmp

        Filesize

        320KB

      • memory/3144-1113-0x00000000072D0000-0x0000000007346000-memory.dmp

        Filesize

        472KB

      • memory/3144-1112-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1111-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1110-0x0000000006B30000-0x000000000705C000-memory.dmp

        Filesize

        5.2MB

      • memory/3144-1109-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1108-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1106-0x0000000006950000-0x0000000006B12000-memory.dmp

        Filesize

        1.8MB

      • memory/3144-1105-0x0000000006610000-0x00000000066A2000-memory.dmp

        Filesize

        584KB

      • memory/3144-1104-0x0000000005F50000-0x0000000005FB6000-memory.dmp

        Filesize

        408KB

      • memory/3144-1103-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1101-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/3144-1100-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/3144-668-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-225-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-223-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-221-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-219-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-217-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-215-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-190-0x0000000000AA0000-0x0000000000AEB000-memory.dmp

        Filesize

        300KB

      • memory/3144-191-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

        Filesize

        64KB

      • memory/3144-192-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-193-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-195-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-197-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-199-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-201-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-203-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-205-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-207-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-209-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-211-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3144-213-0x0000000002770000-0x00000000027AE000-memory.dmp

        Filesize

        248KB

      • memory/3232-1120-0x0000000000E30000-0x0000000000E62000-memory.dmp

        Filesize

        200KB

      • memory/3232-1121-0x0000000005760000-0x0000000005770000-memory.dmp

        Filesize

        64KB

      • memory/3488-173-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-179-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-182-0x0000000004EF0000-0x0000000004F00000-memory.dmp

        Filesize

        64KB

      • memory/3488-181-0x0000000004EF0000-0x0000000004F00000-memory.dmp

        Filesize

        64KB

      • memory/3488-180-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/3488-150-0x0000000004EF0000-0x0000000004F00000-memory.dmp

        Filesize

        64KB

      • memory/3488-171-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-177-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-153-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-175-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-183-0x0000000004EF0000-0x0000000004F00000-memory.dmp

        Filesize

        64KB

      • memory/3488-151-0x0000000004EF0000-0x0000000004F00000-memory.dmp

        Filesize

        64KB

      • memory/3488-161-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-167-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-165-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-163-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-169-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-159-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-157-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-155-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB

      • memory/3488-149-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/3488-148-0x0000000004F00000-0x00000000054A4000-memory.dmp

        Filesize

        5.6MB

      • memory/3488-185-0x0000000000400000-0x000000000070C000-memory.dmp

        Filesize

        3.0MB

      • memory/3488-152-0x0000000004DB0000-0x0000000004DC2000-memory.dmp

        Filesize

        72KB