Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 17:55

General

  • Target

    aaafc5fde1a1cbc90b52d3fd47595e68447cee9bf11fbfa705557a1b6ec3b836.exe

  • Size

    695KB

  • MD5

    b2bee9206b19cae583cfa482379e51ac

  • SHA1

    88e8422227d3b85f8e186e480e128330de8dc44d

  • SHA256

    aaafc5fde1a1cbc90b52d3fd47595e68447cee9bf11fbfa705557a1b6ec3b836

  • SHA512

    4f581cff0fe8bd7d468a35be2b57904c34f08f799bc8f5fa15b25caeb82e3874952de3ce0e8e544ab9f15a86ec0acfa06c33be8dcea9ea3ed9d04016a94d4f36

  • SSDEEP

    12288:fMrVy90XwFjhXBM30TlphPcASqiVmpoW0KbupcMhLWgxwnhDBQs6kIw+5Y:ayqw5hXBM30TlrcD3VQo9K3MIQuhDBQO

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\aaafc5fde1a1cbc90b52d3fd47595e68447cee9bf11fbfa705557a1b6ec3b836.exe
    "C:\Users\Admin\AppData\Local\Temp\aaafc5fde1a1cbc90b52d3fd47595e68447cee9bf11fbfa705557a1b6ec3b836.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un914929.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un914929.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2020.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2020.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2012
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 1084
          4⤵
          • Program crash
          PID:4428
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1724.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1724.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4760
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1860
          4⤵
          • Program crash
          PID:1132
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si243752.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si243752.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4348
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2012 -ip 2012
    1⤵
      PID:232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4760 -ip 4760
      1⤵
        PID:2780

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si243752.exe

        Filesize

        175KB

        MD5

        492b0e333bf6784664b6c8b7195acb13

        SHA1

        83a0ce071ffee9c5236baa7313310efba607c8d3

        SHA256

        aeb3ed8801a10f2d18312c7b799b9731ab969625e6a439dd1487ec164611d761

        SHA512

        b4fd5b1778db482969c674d719d245a1339cf1db4a1bd8daaeca48631aeae8c81030848c7f2a90e299636ac204817a1ef48f992ff0e931e9b571550089bdd30e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si243752.exe

        Filesize

        175KB

        MD5

        492b0e333bf6784664b6c8b7195acb13

        SHA1

        83a0ce071ffee9c5236baa7313310efba607c8d3

        SHA256

        aeb3ed8801a10f2d18312c7b799b9731ab969625e6a439dd1487ec164611d761

        SHA512

        b4fd5b1778db482969c674d719d245a1339cf1db4a1bd8daaeca48631aeae8c81030848c7f2a90e299636ac204817a1ef48f992ff0e931e9b571550089bdd30e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un914929.exe

        Filesize

        553KB

        MD5

        fb97bcc0e6505bd85d7fbd82b6515d2e

        SHA1

        5300589ae7ff15ef2b9d2503194978b2c8801dfd

        SHA256

        a015b0d50f140c6cbc149fc88e2affc69df9b107cac3a6c741450bcb29d4207e

        SHA512

        a8c212c962b4d1871e8e6a11be0475a5659b511afccc31191ccef431745e1462b7a939966358effa096bfe552054a1119527acaabc54a01a48d16697902e2543

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un914929.exe

        Filesize

        553KB

        MD5

        fb97bcc0e6505bd85d7fbd82b6515d2e

        SHA1

        5300589ae7ff15ef2b9d2503194978b2c8801dfd

        SHA256

        a015b0d50f140c6cbc149fc88e2affc69df9b107cac3a6c741450bcb29d4207e

        SHA512

        a8c212c962b4d1871e8e6a11be0475a5659b511afccc31191ccef431745e1462b7a939966358effa096bfe552054a1119527acaabc54a01a48d16697902e2543

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2020.exe

        Filesize

        308KB

        MD5

        2300bbb506fa58388bfe69ace083b40b

        SHA1

        fbd57d1fd05a45f86e7688eed53c0670adb7c912

        SHA256

        74e7f6694cfdde9cc6fc1b8e4e83818841f679dd29f84c652bf7f93054f34796

        SHA512

        1a1cf2694ed0475036bb118ee65c8b32cfce1f5ecc80eaa94d035bd62042a9f690a4c31d6b97a2054a5eb9de397e2db2c9d7cd428d5f81fd24a584e81e380237

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro2020.exe

        Filesize

        308KB

        MD5

        2300bbb506fa58388bfe69ace083b40b

        SHA1

        fbd57d1fd05a45f86e7688eed53c0670adb7c912

        SHA256

        74e7f6694cfdde9cc6fc1b8e4e83818841f679dd29f84c652bf7f93054f34796

        SHA512

        1a1cf2694ed0475036bb118ee65c8b32cfce1f5ecc80eaa94d035bd62042a9f690a4c31d6b97a2054a5eb9de397e2db2c9d7cd428d5f81fd24a584e81e380237

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1724.exe

        Filesize

        366KB

        MD5

        354613eda5907047ba936e3094cbbbce

        SHA1

        c9e8487193d7a4e7fd5c1853a583f0c9f7595c9d

        SHA256

        54525284787e7ec4ac33d1ed58042627f49bd3fd00f06032c8d4dd7181b8df85

        SHA512

        d473d5ecdd48f0dcb55b966d11ffeb48175f439574b11cb8b57770cb533d00ff68d93fd6de442ecf74235229d7d7149834acfa0389f29ec83d8625059c0fbccb

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu1724.exe

        Filesize

        366KB

        MD5

        354613eda5907047ba936e3094cbbbce

        SHA1

        c9e8487193d7a4e7fd5c1853a583f0c9f7595c9d

        SHA256

        54525284787e7ec4ac33d1ed58042627f49bd3fd00f06032c8d4dd7181b8df85

        SHA512

        d473d5ecdd48f0dcb55b966d11ffeb48175f439574b11cb8b57770cb533d00ff68d93fd6de442ecf74235229d7d7149834acfa0389f29ec83d8625059c0fbccb

      • memory/2012-148-0x0000000004C30000-0x00000000051D4000-memory.dmp

        Filesize

        5.6MB

      • memory/2012-149-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/2012-150-0x00000000026C0000-0x00000000026D0000-memory.dmp

        Filesize

        64KB

      • memory/2012-151-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-152-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-154-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-156-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-158-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-160-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-162-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-164-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-166-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-168-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-170-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-172-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-174-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-176-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-178-0x0000000005230000-0x0000000005242000-memory.dmp

        Filesize

        72KB

      • memory/2012-179-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/2012-180-0x00000000026C0000-0x00000000026D0000-memory.dmp

        Filesize

        64KB

      • memory/2012-181-0x00000000026C0000-0x00000000026D0000-memory.dmp

        Filesize

        64KB

      • memory/2012-182-0x00000000026C0000-0x00000000026D0000-memory.dmp

        Filesize

        64KB

      • memory/2012-184-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/4348-1120-0x0000000000230000-0x0000000000262000-memory.dmp

        Filesize

        200KB

      • memory/4348-1123-0x0000000004E10000-0x0000000004E20000-memory.dmp

        Filesize

        64KB

      • memory/4348-1121-0x0000000004E10000-0x0000000004E20000-memory.dmp

        Filesize

        64KB

      • memory/4760-191-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-487-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-193-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-195-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-197-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-199-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-201-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-203-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-205-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-207-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-211-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-209-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-213-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-215-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-217-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-219-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-221-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-223-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-225-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-192-0x0000000004CF0000-0x0000000004D2F000-memory.dmp

        Filesize

        252KB

      • memory/4760-1099-0x00000000054E0000-0x0000000005AF8000-memory.dmp

        Filesize

        6.1MB

      • memory/4760-1100-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/4760-1101-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/4760-1102-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/4760-1103-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-1104-0x0000000005F50000-0x0000000005FE2000-memory.dmp

        Filesize

        584KB

      • memory/4760-1105-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/4760-1107-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-1108-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-1109-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-1110-0x0000000006950000-0x0000000006B12000-memory.dmp

        Filesize

        1.8MB

      • memory/4760-1111-0x0000000006B30000-0x000000000705C000-memory.dmp

        Filesize

        5.2MB

      • memory/4760-190-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB

      • memory/4760-189-0x0000000000720000-0x000000000076B000-memory.dmp

        Filesize

        300KB

      • memory/4760-1112-0x0000000002470000-0x00000000024E6000-memory.dmp

        Filesize

        472KB

      • memory/4760-1113-0x0000000008320000-0x0000000008370000-memory.dmp

        Filesize

        320KB

      • memory/4760-1114-0x0000000004E20000-0x0000000004E30000-memory.dmp

        Filesize

        64KB