Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2023, 19:29

General

  • Target

    9a2f1a9eaadd70eb1052d55aaaaa9993c66c4f32c52a27cd2e5ea14e4f03c79f.exe

  • Size

    696KB

  • MD5

    d63f0a998c714b199c06b6661c3a4037

  • SHA1

    97b48f1fad307ab8ddf80a8343a79d9fb960c375

  • SHA256

    9a2f1a9eaadd70eb1052d55aaaaa9993c66c4f32c52a27cd2e5ea14e4f03c79f

  • SHA512

    9a609d3e1152787b97953cdd55e3d2b5ed8a309a3b9d36f3dc5621cd3baa0e64eb32421e893d432f853daea061dbc025284e0efb3243450f610de9912f61058c

  • SSDEEP

    12288:IMrdy90rv4JLHYnLruoLu+eVQM3mXMl7S7lLvIZeQbrsaMf1dzL0EJkSKQXKjyW0:1ySvvruooVN3mcl7S7lLvIcCGfLx9PyE

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9a2f1a9eaadd70eb1052d55aaaaa9993c66c4f32c52a27cd2e5ea14e4f03c79f.exe
    "C:\Users\Admin\AppData\Local\Temp\9a2f1a9eaadd70eb1052d55aaaaa9993c66c4f32c52a27cd2e5ea14e4f03c79f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001884.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001884.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4504
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4844.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4844.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2258.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2258.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si209446.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si209446.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si209446.exe

    Filesize

    175KB

    MD5

    6a1524f3fabca62b84cc7d980a6af2f0

    SHA1

    bb9844c8a2f8accd01b10156fab31d04c8bec43f

    SHA256

    449dcb3606bb0ed6ce841e372fc8ec5e9ac81ac6f61974f3c08401b993fcdf04

    SHA512

    e6b3393c9d089d00e04ac0efb44c6cc0259ff7bafb595cc092633ae07a038fbb93af5746e12e852c732078f4ff534570b7acadc80335710918c09d09d2738d7c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si209446.exe

    Filesize

    175KB

    MD5

    6a1524f3fabca62b84cc7d980a6af2f0

    SHA1

    bb9844c8a2f8accd01b10156fab31d04c8bec43f

    SHA256

    449dcb3606bb0ed6ce841e372fc8ec5e9ac81ac6f61974f3c08401b993fcdf04

    SHA512

    e6b3393c9d089d00e04ac0efb44c6cc0259ff7bafb595cc092633ae07a038fbb93af5746e12e852c732078f4ff534570b7acadc80335710918c09d09d2738d7c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001884.exe

    Filesize

    554KB

    MD5

    9a80740c8f04920679f2f9e42f664758

    SHA1

    4ffb22221755896b30f9571ea048a397daae0450

    SHA256

    fcfcfd66b82678a5526ca3e43780fd8c9b5ddb0cc8d5cf959e492423dcd6a470

    SHA512

    2b9112d9ae545cb74491f60bc59eef1ff88bf2eb00cb3cffaf08f5c16ebe2bef79b9af91ea6b8763b46565289e1e3c56aa0a882fbc7b5637cdaf5327123586f4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un001884.exe

    Filesize

    554KB

    MD5

    9a80740c8f04920679f2f9e42f664758

    SHA1

    4ffb22221755896b30f9571ea048a397daae0450

    SHA256

    fcfcfd66b82678a5526ca3e43780fd8c9b5ddb0cc8d5cf959e492423dcd6a470

    SHA512

    2b9112d9ae545cb74491f60bc59eef1ff88bf2eb00cb3cffaf08f5c16ebe2bef79b9af91ea6b8763b46565289e1e3c56aa0a882fbc7b5637cdaf5327123586f4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4844.exe

    Filesize

    308KB

    MD5

    daa930e2177cfa20e6c0419bfd6f1ec6

    SHA1

    60c8801f44247d92e64730539807c47e2baedaf0

    SHA256

    289faa63cb92d4bb9c0b6574ba1c6848d103ef479b5c6bb3c2b1cba6c64cbefb

    SHA512

    625036344dead19849147e70f7232e9a76786aac4ff0f422ae2c1d89f66e45bc81aef33633c65be2af2c61fcd85bd89a47415b77bf0886a5048f29a5daa038cf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4844.exe

    Filesize

    308KB

    MD5

    daa930e2177cfa20e6c0419bfd6f1ec6

    SHA1

    60c8801f44247d92e64730539807c47e2baedaf0

    SHA256

    289faa63cb92d4bb9c0b6574ba1c6848d103ef479b5c6bb3c2b1cba6c64cbefb

    SHA512

    625036344dead19849147e70f7232e9a76786aac4ff0f422ae2c1d89f66e45bc81aef33633c65be2af2c61fcd85bd89a47415b77bf0886a5048f29a5daa038cf

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2258.exe

    Filesize

    366KB

    MD5

    8a59138536ccd64f5f06347b242684fa

    SHA1

    9caba4bc4c10b5e4378fe52c1c2a3564d444acf7

    SHA256

    32f4b43ffd4d9e985d00593916919513d39a72a269fdaca039f793a6da2ec137

    SHA512

    d95f0dcd91141c8fe0f50a51e1e1b98755e83f0e69c4258adfa2ea02955035734e4f33d5bf8d363053b7ba6ccf2c721420bf2a1fa0e53cacfede9e45f9fc59e6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu2258.exe

    Filesize

    366KB

    MD5

    8a59138536ccd64f5f06347b242684fa

    SHA1

    9caba4bc4c10b5e4378fe52c1c2a3564d444acf7

    SHA256

    32f4b43ffd4d9e985d00593916919513d39a72a269fdaca039f793a6da2ec137

    SHA512

    d95f0dcd91141c8fe0f50a51e1e1b98755e83f0e69c4258adfa2ea02955035734e4f33d5bf8d363053b7ba6ccf2c721420bf2a1fa0e53cacfede9e45f9fc59e6

  • memory/1172-148-0x0000000004F90000-0x0000000005534000-memory.dmp

    Filesize

    5.6MB

  • memory/1172-149-0x0000000000710000-0x000000000073D000-memory.dmp

    Filesize

    180KB

  • memory/1172-150-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/1172-152-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-151-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/1172-154-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-153-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/1172-156-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-158-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-160-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-162-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-164-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-166-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-168-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-170-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-172-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-174-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-176-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-178-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-180-0x00000000027B0000-0x00000000027C2000-memory.dmp

    Filesize

    72KB

  • memory/1172-181-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/1172-182-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/1172-183-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/1172-184-0x0000000004F80000-0x0000000004F90000-memory.dmp

    Filesize

    64KB

  • memory/1172-186-0x0000000000400000-0x000000000070F000-memory.dmp

    Filesize

    3.1MB

  • memory/4928-191-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-192-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-194-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-196-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-198-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-200-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-202-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-204-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-206-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-208-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-210-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-212-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-214-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-216-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-218-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-222-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-220-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-224-0x0000000002830000-0x000000000286F000-memory.dmp

    Filesize

    252KB

  • memory/4928-259-0x00000000007F0000-0x000000000083B000-memory.dmp

    Filesize

    300KB

  • memory/4928-261-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-263-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-265-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-1101-0x00000000054A0000-0x0000000005AB8000-memory.dmp

    Filesize

    6.1MB

  • memory/4928-1102-0x0000000005AC0000-0x0000000005BCA000-memory.dmp

    Filesize

    1.0MB

  • memory/4928-1103-0x0000000004E10000-0x0000000004E22000-memory.dmp

    Filesize

    72KB

  • memory/4928-1104-0x0000000004E30000-0x0000000004E6C000-memory.dmp

    Filesize

    240KB

  • memory/4928-1105-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-1106-0x0000000005E10000-0x0000000005E76000-memory.dmp

    Filesize

    408KB

  • memory/4928-1107-0x00000000064D0000-0x0000000006562000-memory.dmp

    Filesize

    584KB

  • memory/4928-1109-0x00000000065D0000-0x0000000006792000-memory.dmp

    Filesize

    1.8MB

  • memory/4928-1110-0x00000000067B0000-0x0000000006CDC000-memory.dmp

    Filesize

    5.2MB

  • memory/4928-1111-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-1112-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-1113-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4928-1114-0x0000000006F20000-0x0000000006F96000-memory.dmp

    Filesize

    472KB

  • memory/4928-1115-0x0000000006FA0000-0x0000000006FF0000-memory.dmp

    Filesize

    320KB

  • memory/4928-1116-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

    Filesize

    64KB

  • memory/4960-1122-0x0000000000310000-0x0000000000342000-memory.dmp

    Filesize

    200KB

  • memory/4960-1123-0x0000000004BD0000-0x0000000004BE0000-memory.dmp

    Filesize

    64KB