Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    109s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 17:55

General

  • Target

    d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe

  • Size

    685KB

  • MD5

    4d1b737599fc00d1266c6e75bd0c462b

  • SHA1

    7e60e32757b5d91da993709a4eca487ec374d830

  • SHA256

    d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632

  • SHA512

    ad991120383e85e40544da816d4d9540d6def81f1b236c6c196399ecd2ee810805607184c13da5993ccca2e3a6c21a10cccbcd57ffbcb01e9549409cdd232249

  • SSDEEP

    12288:VvtNOg7nu2/JsK1yeuLwX0cz1C4WvFwWR0CqRjDdODDUP2fxrjNbM9:bhD/JsdeFXAqWRJ81oc2fx3m9

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 32 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe
    "C:\Users\Admin\AppData\Local\Temp\d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4936
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 1524
          4⤵
          • Program crash
          PID:3848
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 472
      2⤵
      • Program crash
      PID:4132
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4296 -ip 4296
    1⤵
      PID:968
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3456 -ip 3456
      1⤵
        PID:2252

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exe

        Filesize

        175KB

        MD5

        932a6f58e5bc64dd878861f91ac7cbf0

        SHA1

        18c827032ec818af17f8afe9e4b45f075d83b657

        SHA256

        46f3a3fbf0b4534c1348f9955b9ce0c06325980da5c874af4dd2aef7802f9f58

        SHA512

        48104962db4087c986aeaadae40452a7cadee21973717bd5eb94350a3bb233f10d09353f4b36a9462d5769cb7865a4e824b6590506340c30ac3fc16e8da796e9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exe

        Filesize

        175KB

        MD5

        932a6f58e5bc64dd878861f91ac7cbf0

        SHA1

        18c827032ec818af17f8afe9e4b45f075d83b657

        SHA256

        46f3a3fbf0b4534c1348f9955b9ce0c06325980da5c874af4dd2aef7802f9f58

        SHA512

        48104962db4087c986aeaadae40452a7cadee21973717bd5eb94350a3bb233f10d09353f4b36a9462d5769cb7865a4e824b6590506340c30ac3fc16e8da796e9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exe

        Filesize

        413KB

        MD5

        5a79c32fdb49be7fa83478e78644bfa9

        SHA1

        40752abae6038844460e651a663f59f03bc088a5

        SHA256

        a1c9068ef36337eec44ec4422519d9ee0c71f6e10bf4816a4f4101bf6c8b478b

        SHA512

        673b7ae49b62424af6e798364c721a988bd5dad791d11d8ca60cc1a1010d4df241a3e3f2188b39cbd014ac037ab39c00a8c2378f583dec5420b8c8ec737b075b

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exe

        Filesize

        413KB

        MD5

        5a79c32fdb49be7fa83478e78644bfa9

        SHA1

        40752abae6038844460e651a663f59f03bc088a5

        SHA256

        a1c9068ef36337eec44ec4422519d9ee0c71f6e10bf4816a4f4101bf6c8b478b

        SHA512

        673b7ae49b62424af6e798364c721a988bd5dad791d11d8ca60cc1a1010d4df241a3e3f2188b39cbd014ac037ab39c00a8c2378f583dec5420b8c8ec737b075b

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exe

        Filesize

        13KB

        MD5

        509a43f278645c0b9dd10497db99a1ad

        SHA1

        1f7e1fc91c81f6c7a2b09bea8caf2ad2b756c71c

        SHA256

        9c229f2174392b7bb35cc5761384796f2a05d4b00503979e7b3b0ddad6c8672e

        SHA512

        1af8fc70063b33ac9df31d6e510511fe37f685017383fbe6a702fd2012954809cfeaf6c8b3e186839f0df80b947ace931d604c216e53fa11a47302cf7b604fe8

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exe

        Filesize

        13KB

        MD5

        509a43f278645c0b9dd10497db99a1ad

        SHA1

        1f7e1fc91c81f6c7a2b09bea8caf2ad2b756c71c

        SHA256

        9c229f2174392b7bb35cc5761384796f2a05d4b00503979e7b3b0ddad6c8672e

        SHA512

        1af8fc70063b33ac9df31d6e510511fe37f685017383fbe6a702fd2012954809cfeaf6c8b3e186839f0df80b947ace931d604c216e53fa11a47302cf7b604fe8

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exe

        Filesize

        366KB

        MD5

        1db7ddeeb37c9274f031263ad2022274

        SHA1

        44377ce985b07caca113b40013179d5ff1ef0daf

        SHA256

        7217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61

        SHA512

        72f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exe

        Filesize

        366KB

        MD5

        1db7ddeeb37c9274f031263ad2022274

        SHA1

        44377ce985b07caca113b40013179d5ff1ef0daf

        SHA256

        7217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61

        SHA512

        72f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d

      • memory/3456-134-0x0000000002870000-0x00000000028FC000-memory.dmp

        Filesize

        560KB

      • memory/3456-150-0x0000000000400000-0x0000000000B3E000-memory.dmp

        Filesize

        7.2MB

      • memory/4296-196-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-206-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-159-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-160-0x0000000004CF0000-0x0000000005294000-memory.dmp

        Filesize

        5.6MB

      • memory/4296-161-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-162-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-164-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-166-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-168-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-170-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-172-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-174-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-176-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-178-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-180-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-182-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-184-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-192-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-190-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-188-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-186-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-194-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-157-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-198-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-200-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-202-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-204-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-158-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-208-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-210-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-212-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-214-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-216-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-218-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-220-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-222-0x00000000052A0000-0x00000000052DF000-memory.dmp

        Filesize

        252KB

      • memory/4296-1067-0x0000000005460000-0x0000000005A78000-memory.dmp

        Filesize

        6.1MB

      • memory/4296-1068-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/4296-1069-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/4296-1070-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/4296-1071-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-1073-0x0000000005F50000-0x0000000005FB6000-memory.dmp

        Filesize

        408KB

      • memory/4296-1074-0x0000000006610000-0x00000000066A2000-memory.dmp

        Filesize

        584KB

      • memory/4296-1076-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-1077-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-1078-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4296-1079-0x0000000006710000-0x00000000068D2000-memory.dmp

        Filesize

        1.8MB

      • memory/4296-1080-0x00000000068E0000-0x0000000006E0C000-memory.dmp

        Filesize

        5.2MB

      • memory/4296-1081-0x0000000006F60000-0x0000000006FD6000-memory.dmp

        Filesize

        472KB

      • memory/4296-1082-0x0000000006FE0000-0x0000000007030000-memory.dmp

        Filesize

        320KB

      • memory/4296-156-0x0000000000810000-0x000000000085B000-memory.dmp

        Filesize

        300KB

      • memory/4296-1083-0x0000000002770000-0x0000000002780000-memory.dmp

        Filesize

        64KB

      • memory/4632-1090-0x0000000000530000-0x0000000000562000-memory.dmp

        Filesize

        200KB

      • memory/4632-1091-0x0000000005250000-0x0000000005260000-memory.dmp

        Filesize

        64KB

      • memory/4632-1093-0x0000000005250000-0x0000000005260000-memory.dmp

        Filesize

        64KB

      • memory/4936-149-0x00000000006E0000-0x00000000006EA000-memory.dmp

        Filesize

        40KB