Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
109s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2023, 17:55
Static task
static1
Behavioral task
behavioral1
Sample
d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe
Resource
win10v2004-20230220-en
General
-
Target
d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe
-
Size
685KB
-
MD5
4d1b737599fc00d1266c6e75bd0c462b
-
SHA1
7e60e32757b5d91da993709a4eca487ec374d830
-
SHA256
d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632
-
SHA512
ad991120383e85e40544da816d4d9540d6def81f1b236c6c196399ecd2ee810805607184c13da5993ccca2e3a6c21a10cccbcd57ffbcb01e9549409cdd232249
-
SSDEEP
12288:VvtNOg7nu2/JsK1yeuLwX0cz1C4WvFwWR0CqRjDdODDUP2fxrjNbM9:bhD/JsdeFXAqWRJ81oc2fx3m9
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr219208.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr219208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr219208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr219208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr219208.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr219208.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 32 IoCs
resource yara_rule behavioral1/memory/4296-161-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-162-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-164-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-166-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-168-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-170-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-172-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-174-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-176-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-178-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-180-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-182-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-184-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-192-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-190-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-188-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-186-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-194-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-196-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-198-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-200-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-202-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-204-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-206-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-208-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-210-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-212-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-214-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-216-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-218-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-220-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline behavioral1/memory/4296-222-0x00000000052A0000-0x00000000052DF000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 5036 zigm3131.exe 4936 jr219208.exe 4296 ku920385.exe 4632 lr826811.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr219208.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zigm3131.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zigm3131.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 2 IoCs
pid pid_target Process procid_target 3848 4296 WerFault.exe 90 4132 3456 WerFault.exe 84 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4936 jr219208.exe 4936 jr219208.exe 4296 ku920385.exe 4296 ku920385.exe 4632 lr826811.exe 4632 lr826811.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4936 jr219208.exe Token: SeDebugPrivilege 4296 ku920385.exe Token: SeDebugPrivilege 4632 lr826811.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3456 wrote to memory of 5036 3456 d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe 85 PID 3456 wrote to memory of 5036 3456 d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe 85 PID 3456 wrote to memory of 5036 3456 d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe 85 PID 5036 wrote to memory of 4936 5036 zigm3131.exe 86 PID 5036 wrote to memory of 4936 5036 zigm3131.exe 86 PID 5036 wrote to memory of 4296 5036 zigm3131.exe 90 PID 5036 wrote to memory of 4296 5036 zigm3131.exe 90 PID 5036 wrote to memory of 4296 5036 zigm3131.exe 90 PID 3456 wrote to memory of 4632 3456 d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe 94 PID 3456 wrote to memory of 4632 3456 d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe 94 PID 3456 wrote to memory of 4632 3456 d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe"C:\Users\Admin\AppData\Local\Temp\d619df28eb3f76580ed0b6ab96f82926ee59a3dfd59df61449820a45df080632.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zigm3131.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr219208.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4936
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku920385.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 15244⤵
- Program crash
PID:3848
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr826811.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 4722⤵
- Program crash
PID:4132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4296 -ip 42961⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3456 -ip 34561⤵PID:2252
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5932a6f58e5bc64dd878861f91ac7cbf0
SHA118c827032ec818af17f8afe9e4b45f075d83b657
SHA25646f3a3fbf0b4534c1348f9955b9ce0c06325980da5c874af4dd2aef7802f9f58
SHA51248104962db4087c986aeaadae40452a7cadee21973717bd5eb94350a3bb233f10d09353f4b36a9462d5769cb7865a4e824b6590506340c30ac3fc16e8da796e9
-
Filesize
175KB
MD5932a6f58e5bc64dd878861f91ac7cbf0
SHA118c827032ec818af17f8afe9e4b45f075d83b657
SHA25646f3a3fbf0b4534c1348f9955b9ce0c06325980da5c874af4dd2aef7802f9f58
SHA51248104962db4087c986aeaadae40452a7cadee21973717bd5eb94350a3bb233f10d09353f4b36a9462d5769cb7865a4e824b6590506340c30ac3fc16e8da796e9
-
Filesize
413KB
MD55a79c32fdb49be7fa83478e78644bfa9
SHA140752abae6038844460e651a663f59f03bc088a5
SHA256a1c9068ef36337eec44ec4422519d9ee0c71f6e10bf4816a4f4101bf6c8b478b
SHA512673b7ae49b62424af6e798364c721a988bd5dad791d11d8ca60cc1a1010d4df241a3e3f2188b39cbd014ac037ab39c00a8c2378f583dec5420b8c8ec737b075b
-
Filesize
413KB
MD55a79c32fdb49be7fa83478e78644bfa9
SHA140752abae6038844460e651a663f59f03bc088a5
SHA256a1c9068ef36337eec44ec4422519d9ee0c71f6e10bf4816a4f4101bf6c8b478b
SHA512673b7ae49b62424af6e798364c721a988bd5dad791d11d8ca60cc1a1010d4df241a3e3f2188b39cbd014ac037ab39c00a8c2378f583dec5420b8c8ec737b075b
-
Filesize
13KB
MD5509a43f278645c0b9dd10497db99a1ad
SHA11f7e1fc91c81f6c7a2b09bea8caf2ad2b756c71c
SHA2569c229f2174392b7bb35cc5761384796f2a05d4b00503979e7b3b0ddad6c8672e
SHA5121af8fc70063b33ac9df31d6e510511fe37f685017383fbe6a702fd2012954809cfeaf6c8b3e186839f0df80b947ace931d604c216e53fa11a47302cf7b604fe8
-
Filesize
13KB
MD5509a43f278645c0b9dd10497db99a1ad
SHA11f7e1fc91c81f6c7a2b09bea8caf2ad2b756c71c
SHA2569c229f2174392b7bb35cc5761384796f2a05d4b00503979e7b3b0ddad6c8672e
SHA5121af8fc70063b33ac9df31d6e510511fe37f685017383fbe6a702fd2012954809cfeaf6c8b3e186839f0df80b947ace931d604c216e53fa11a47302cf7b604fe8
-
Filesize
366KB
MD51db7ddeeb37c9274f031263ad2022274
SHA144377ce985b07caca113b40013179d5ff1ef0daf
SHA2567217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61
SHA51272f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d
-
Filesize
366KB
MD51db7ddeeb37c9274f031263ad2022274
SHA144377ce985b07caca113b40013179d5ff1ef0daf
SHA2567217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61
SHA51272f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d