Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 18:08

General

  • Target

    79b5713ebf3914402fcfc60da319bfa42392faa5b1d5b6b37bd9ed55eeb7fb1c.exe

  • Size

    700KB

  • MD5

    021b171a80a22c805479a07091ef4ef4

  • SHA1

    aee7ac33575905a10e05855f4759b8086c92a5b4

  • SHA256

    79b5713ebf3914402fcfc60da319bfa42392faa5b1d5b6b37bd9ed55eeb7fb1c

  • SHA512

    e482f579984cbc589639167ffc481f9ac7f7c53d43a3b471cc05f123db343c91e0afcc150376006ed9c17ef1d38329bf527aa3d887e91a130cbcf4285ac27a2e

  • SSDEEP

    12288:6Mrzy90Uzi1M3Aj4U1IhlMyQO25TBr1i3Fx1z3xYiKiE9NwPYNL/3M7YgTFTRDVt:ByvzPhqO25Td1if1rxFS9NAYl/M7YgBN

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79b5713ebf3914402fcfc60da319bfa42392faa5b1d5b6b37bd9ed55eeb7fb1c.exe
    "C:\Users\Admin\AppData\Local\Temp\79b5713ebf3914402fcfc60da319bfa42392faa5b1d5b6b37bd9ed55eeb7fb1c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280796.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280796.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:316
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0408.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0408.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5000
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1084
          4⤵
          • Program crash
          PID:3532
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6925.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6925.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2204
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1860
          4⤵
          • Program crash
          PID:5100
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995075.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995075.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4368
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5000 -ip 5000
    1⤵
      PID:4508
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2204 -ip 2204
      1⤵
        PID:4292

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995075.exe

        Filesize

        175KB

        MD5

        85525c0daa2135600ca040c22eb5953f

        SHA1

        f72f32cec522bafc8c1f50103160c254c306d12a

        SHA256

        995eeede23ed0411190bc3ee2e8454b918aa825ddcbacce187775b2a94dbdb2b

        SHA512

        a48e7c845ced6226b275fe998b26c053ce21559f9d0b4dd9a55b3d4322374e1b3cef0859543972af8f93c059654c394e76e61ae6435e0a814b7590c1457a639f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si995075.exe

        Filesize

        175KB

        MD5

        85525c0daa2135600ca040c22eb5953f

        SHA1

        f72f32cec522bafc8c1f50103160c254c306d12a

        SHA256

        995eeede23ed0411190bc3ee2e8454b918aa825ddcbacce187775b2a94dbdb2b

        SHA512

        a48e7c845ced6226b275fe998b26c053ce21559f9d0b4dd9a55b3d4322374e1b3cef0859543972af8f93c059654c394e76e61ae6435e0a814b7590c1457a639f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280796.exe

        Filesize

        558KB

        MD5

        8979221dbf9e4241742b623d914a17d8

        SHA1

        bafada3666b43bdb6e32994e4190e51ca678b352

        SHA256

        f228d54d37532ff62c5e2dd1e9a0a4584672f4c8120cd6f3dffb3d29aa1c4145

        SHA512

        11821433ebf5d116eb4719a034b50b0f5693a066c76913024145c5910a1e2b6dcb885bc9704d1beeae7d52ed05a27051c35ec47db9be5f2a7d136b4b8eb673cf

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un280796.exe

        Filesize

        558KB

        MD5

        8979221dbf9e4241742b623d914a17d8

        SHA1

        bafada3666b43bdb6e32994e4190e51ca678b352

        SHA256

        f228d54d37532ff62c5e2dd1e9a0a4584672f4c8120cd6f3dffb3d29aa1c4145

        SHA512

        11821433ebf5d116eb4719a034b50b0f5693a066c76913024145c5910a1e2b6dcb885bc9704d1beeae7d52ed05a27051c35ec47db9be5f2a7d136b4b8eb673cf

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0408.exe

        Filesize

        307KB

        MD5

        ef3bd235dc7bf6ebecf53fde55b9bdfe

        SHA1

        e28f1de8f210c906e1b753b709332567faf4d4dd

        SHA256

        bf3d83a26b3084f1af14a4fcca42f1d3f207d648773aaff9e6e9b936f9adadae

        SHA512

        5ac64f4f025f65f7aa572d6cb8b5cecff64001a99add418687a1d29d8fc1830ef04c5328a8884c6192e58e15918914e12404a48f5322daaef6b5f1ee6283547e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0408.exe

        Filesize

        307KB

        MD5

        ef3bd235dc7bf6ebecf53fde55b9bdfe

        SHA1

        e28f1de8f210c906e1b753b709332567faf4d4dd

        SHA256

        bf3d83a26b3084f1af14a4fcca42f1d3f207d648773aaff9e6e9b936f9adadae

        SHA512

        5ac64f4f025f65f7aa572d6cb8b5cecff64001a99add418687a1d29d8fc1830ef04c5328a8884c6192e58e15918914e12404a48f5322daaef6b5f1ee6283547e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6925.exe

        Filesize

        366KB

        MD5

        4a3f4b3e802a00b8f2a8c2da04ca1a42

        SHA1

        3db2831c3a55b06378a432a228d438b831466c7e

        SHA256

        15f97daf7733eebd7eea0524c0a99a45557613ec6544fcb1e70836335012e36a

        SHA512

        872fbd7a04675ae2e65b2c5b87dd2a454fea324eb425b254fe4b901eda7368f77e10060f809ed8f2001ebfc4d8cf3a34347728348fd5ec052a40e061bb22ab7a

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6925.exe

        Filesize

        366KB

        MD5

        4a3f4b3e802a00b8f2a8c2da04ca1a42

        SHA1

        3db2831c3a55b06378a432a228d438b831466c7e

        SHA256

        15f97daf7733eebd7eea0524c0a99a45557613ec6544fcb1e70836335012e36a

        SHA512

        872fbd7a04675ae2e65b2c5b87dd2a454fea324eb425b254fe4b901eda7368f77e10060f809ed8f2001ebfc4d8cf3a34347728348fd5ec052a40e061bb22ab7a

      • memory/2204-1102-0x0000000004E50000-0x0000000004E62000-memory.dmp

        Filesize

        72KB

      • memory/2204-1103-0x0000000005C80000-0x0000000005CBC000-memory.dmp

        Filesize

        240KB

      • memory/2204-1115-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-1114-0x0000000006AE0000-0x000000000700C000-memory.dmp

        Filesize

        5.2MB

      • memory/2204-1113-0x00000000068F0000-0x0000000006AB2000-memory.dmp

        Filesize

        1.8MB

      • memory/2204-1112-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-1111-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-1110-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-1109-0x0000000006780000-0x00000000067D0000-memory.dmp

        Filesize

        320KB

      • memory/2204-1108-0x00000000066F0000-0x0000000006766000-memory.dmp

        Filesize

        472KB

      • memory/2204-1106-0x0000000005FF0000-0x0000000006056000-memory.dmp

        Filesize

        408KB

      • memory/2204-1105-0x0000000005F50000-0x0000000005FE2000-memory.dmp

        Filesize

        584KB

      • memory/2204-1104-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-205-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-1101-0x0000000005B70000-0x0000000005C7A000-memory.dmp

        Filesize

        1.0MB

      • memory/2204-1100-0x0000000005550000-0x0000000005B68000-memory.dmp

        Filesize

        6.1MB

      • memory/2204-485-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-487-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-482-0x0000000004E90000-0x0000000004EA0000-memory.dmp

        Filesize

        64KB

      • memory/2204-209-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-223-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-221-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-190-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-191-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-193-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-195-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-197-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-199-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-201-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-203-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-219-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-211-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-481-0x00000000007F0000-0x000000000083B000-memory.dmp

        Filesize

        300KB

      • memory/2204-207-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-213-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-215-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/2204-217-0x00000000026A0000-0x00000000026DF000-memory.dmp

        Filesize

        252KB

      • memory/4368-1121-0x0000000000170000-0x00000000001A2000-memory.dmp

        Filesize

        200KB

      • memory/4368-1123-0x0000000004D20000-0x0000000004D30000-memory.dmp

        Filesize

        64KB

      • memory/4368-1122-0x0000000004D20000-0x0000000004D30000-memory.dmp

        Filesize

        64KB

      • memory/5000-149-0x00000000007E0000-0x000000000080D000-memory.dmp

        Filesize

        180KB

      • memory/5000-168-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-182-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

        Filesize

        64KB

      • memory/5000-181-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/5000-180-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-178-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-150-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

        Filesize

        64KB

      • memory/5000-176-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-153-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-174-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-185-0x0000000000400000-0x0000000000710000-memory.dmp

        Filesize

        3.1MB

      • memory/5000-183-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

        Filesize

        64KB

      • memory/5000-166-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-164-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-162-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-160-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-158-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-156-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-154-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-172-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-148-0x0000000004DF0000-0x0000000005394000-memory.dmp

        Filesize

        5.6MB

      • memory/5000-170-0x0000000002680000-0x0000000002692000-memory.dmp

        Filesize

        72KB

      • memory/5000-152-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

        Filesize

        64KB

      • memory/5000-151-0x0000000004DE0000-0x0000000004DF0000-memory.dmp

        Filesize

        64KB