Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 18:01

General

  • Target

    63b4f86f6e094ed68e2da3ecf003605e743105d3fab1f1992d3896bc9bf0c3eb.exe

  • Size

    675KB

  • MD5

    b1b9edba3110d3f6e1d37249f7c69ea5

  • SHA1

    805be968dd146cb68492d9a6759ba6551f555008

  • SHA256

    63b4f86f6e094ed68e2da3ecf003605e743105d3fab1f1992d3896bc9bf0c3eb

  • SHA512

    f4701376b91264b777db007ffe8dcbc0ce206765f0126487e2f944450687e48524d1edf1d7eca60231379f31ee4e20bc201e67552b2f594df6f41a2742cf1331

  • SSDEEP

    12288:uMrsy90rGERgVYhFUUuG38kMcXBkFzW3WzNVNbo8kYZ0rWwaEJU46/BP:GyuiuBPRMcWFzbzTpJkvrWnb/5

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63b4f86f6e094ed68e2da3ecf003605e743105d3fab1f1992d3896bc9bf0c3eb.exe
    "C:\Users\Admin\AppData\Local\Temp\63b4f86f6e094ed68e2da3ecf003605e743105d3fab1f1992d3896bc9bf0c3eb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un841637.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un841637.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0378.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0378.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1044 -s 1084
          4⤵
          • Program crash
          PID:4884
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9649.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9649.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3380
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 1360
          4⤵
          • Program crash
          PID:3856
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si336700.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si336700.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1044 -ip 1044
    1⤵
      PID:4168
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3380 -ip 3380
      1⤵
        PID:4488

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si336700.exe

        Filesize

        175KB

        MD5

        20a5a004d0bb6486fb4eae3e4684126e

        SHA1

        842ff9af58c557ad1e30039543f03d2a7e6e8e50

        SHA256

        43a7e505c2f158df7c50412f8b9382e8fcc6e457a047d18cadbb5ad0f0de788d

        SHA512

        39857ce727db56ba8799bfa444a1a6183b02d0315c732e5fc716e15fd9c5be6a5be811a60c37cd4e8d2b2653f095d7f29fbc3ecc15d1045d05109007a8428cac

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si336700.exe

        Filesize

        175KB

        MD5

        20a5a004d0bb6486fb4eae3e4684126e

        SHA1

        842ff9af58c557ad1e30039543f03d2a7e6e8e50

        SHA256

        43a7e505c2f158df7c50412f8b9382e8fcc6e457a047d18cadbb5ad0f0de788d

        SHA512

        39857ce727db56ba8799bfa444a1a6183b02d0315c732e5fc716e15fd9c5be6a5be811a60c37cd4e8d2b2653f095d7f29fbc3ecc15d1045d05109007a8428cac

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un841637.exe

        Filesize

        533KB

        MD5

        003d6947d9bda4b0a4c6646e227e93dc

        SHA1

        3f57e87737c902d4d4c06a5c9c9ea327d8a9c83e

        SHA256

        503bec83c85e294ed8eb814e50696e4b74c050c8b248e3c775ba4122030b75fe

        SHA512

        9321e3822c84b9449e6746d699e2cbbe3e82e2f5e966b706dcdf8ea799e29cba25ec7972c777de6ae4ddeab539907926ad30df317b3f6b759cf02a44dd17eca2

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un841637.exe

        Filesize

        533KB

        MD5

        003d6947d9bda4b0a4c6646e227e93dc

        SHA1

        3f57e87737c902d4d4c06a5c9c9ea327d8a9c83e

        SHA256

        503bec83c85e294ed8eb814e50696e4b74c050c8b248e3c775ba4122030b75fe

        SHA512

        9321e3822c84b9449e6746d699e2cbbe3e82e2f5e966b706dcdf8ea799e29cba25ec7972c777de6ae4ddeab539907926ad30df317b3f6b759cf02a44dd17eca2

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0378.exe

        Filesize

        272KB

        MD5

        ae964d4a5a332d4a89018bdcbeeb6f5b

        SHA1

        17555a475d322a056e37fa129ca53cdb0f173936

        SHA256

        df11f77c3a7bf8afaaa941812fb260187b8ebccedc23cfad095f226f38a347a8

        SHA512

        2c70d591d0b079f6e787436f7d2e8ce2cba12e643f2c6912f7c26127386543187299d3880a29a393ebeaae6ce2ed36103b56ed5e5df6cc4f01172a34583d9225

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0378.exe

        Filesize

        272KB

        MD5

        ae964d4a5a332d4a89018bdcbeeb6f5b

        SHA1

        17555a475d322a056e37fa129ca53cdb0f173936

        SHA256

        df11f77c3a7bf8afaaa941812fb260187b8ebccedc23cfad095f226f38a347a8

        SHA512

        2c70d591d0b079f6e787436f7d2e8ce2cba12e643f2c6912f7c26127386543187299d3880a29a393ebeaae6ce2ed36103b56ed5e5df6cc4f01172a34583d9225

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9649.exe

        Filesize

        331KB

        MD5

        5a86bdae19d5d3d4d7d9d910e25040cd

        SHA1

        fe38880773db726ff80cb609a4bce3ce60422393

        SHA256

        1645427f2ff49dd34856e011880f2383589ef3eb09e18aee53eb7c0d996d2b64

        SHA512

        b6c2f5eb3a6e61ef9c5024d9f5e16452df91e2bc35509d5c5f5ac95d99163704b11a4cb79b5421a7cb0086cbf0d7865d4cb65ce784aab9abbba1e2a08a507248

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9649.exe

        Filesize

        331KB

        MD5

        5a86bdae19d5d3d4d7d9d910e25040cd

        SHA1

        fe38880773db726ff80cb609a4bce3ce60422393

        SHA256

        1645427f2ff49dd34856e011880f2383589ef3eb09e18aee53eb7c0d996d2b64

        SHA512

        b6c2f5eb3a6e61ef9c5024d9f5e16452df91e2bc35509d5c5f5ac95d99163704b11a4cb79b5421a7cb0086cbf0d7865d4cb65ce784aab9abbba1e2a08a507248

      • memory/1044-148-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/1044-149-0x0000000002920000-0x0000000002930000-memory.dmp

        Filesize

        64KB

      • memory/1044-150-0x0000000004DA0000-0x0000000005344000-memory.dmp

        Filesize

        5.6MB

      • memory/1044-151-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-152-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-154-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-156-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-158-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-160-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-162-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-164-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-166-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-168-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-170-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-172-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-174-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-176-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-178-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/1044-179-0x0000000000400000-0x0000000000707000-memory.dmp

        Filesize

        3.0MB

      • memory/1044-180-0x0000000002920000-0x0000000002930000-memory.dmp

        Filesize

        64KB

      • memory/1044-182-0x0000000000400000-0x0000000000707000-memory.dmp

        Filesize

        3.0MB

      • memory/3380-188-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-187-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-190-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-192-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-194-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-196-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-198-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-200-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-202-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-204-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-206-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-212-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-210-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-214-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-208-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-216-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-218-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-220-0x00000000029B0000-0x00000000029EF000-memory.dmp

        Filesize

        252KB

      • memory/3380-437-0x00000000007F0000-0x000000000083B000-memory.dmp

        Filesize

        300KB

      • memory/3380-439-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-441-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-443-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-1097-0x0000000005480000-0x0000000005A98000-memory.dmp

        Filesize

        6.1MB

      • memory/3380-1098-0x0000000005B00000-0x0000000005C0A000-memory.dmp

        Filesize

        1.0MB

      • memory/3380-1099-0x0000000005C40000-0x0000000005C52000-memory.dmp

        Filesize

        72KB

      • memory/3380-1100-0x0000000005C60000-0x0000000005C9C000-memory.dmp

        Filesize

        240KB

      • memory/3380-1101-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-1102-0x0000000005F50000-0x0000000005FE2000-memory.dmp

        Filesize

        584KB

      • memory/3380-1103-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/3380-1104-0x00000000066E0000-0x0000000006756000-memory.dmp

        Filesize

        472KB

      • memory/3380-1105-0x0000000006780000-0x00000000067D0000-memory.dmp

        Filesize

        320KB

      • memory/3380-1107-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-1108-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-1109-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3380-1110-0x0000000006A30000-0x0000000006BF2000-memory.dmp

        Filesize

        1.8MB

      • memory/3380-1111-0x0000000006C50000-0x000000000717C000-memory.dmp

        Filesize

        5.2MB

      • memory/3380-1112-0x0000000002400000-0x0000000002410000-memory.dmp

        Filesize

        64KB

      • memory/3488-1118-0x0000000000280000-0x00000000002B2000-memory.dmp

        Filesize

        200KB

      • memory/3488-1119-0x0000000004B40000-0x0000000004B50000-memory.dmp

        Filesize

        64KB