Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2023, 01:13

General

  • Target

    cbc72b0dc106c43127976fd82c91258084126feec416bd003242921faa737467.exe

  • Size

    690KB

  • MD5

    a890236695a8fdd4ac84b99c4b7ec8bc

  • SHA1

    2d1b161ac5ce9bb891a4286ccfbf98e902d13cc4

  • SHA256

    cbc72b0dc106c43127976fd82c91258084126feec416bd003242921faa737467

  • SHA512

    c073379f74252681e4dfc9d210e5f62629426799209ad9007be275fa0dd3801c404a574f1858a076f1d7da30d050a42b31aeb6666c8ee1056edafc45026012eb

  • SSDEEP

    12288:JMrey90BZtLMKiw8dYik6GSyi65hLuYTRXN+3vr2tv5vFFJ4fig+K44E/sHo7:Xy6tLbiw8dfknfxfaoR9+D2B5HJ4agNc

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbc72b0dc106c43127976fd82c91258084126feec416bd003242921faa737467.exe
    "C:\Users\Admin\AppData\Local\Temp\cbc72b0dc106c43127976fd82c91258084126feec416bd003242921faa737467.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2456
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un987548.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un987548.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0335.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0335.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1472
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 1084
          4⤵
          • Program crash
          PID:5036
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6543.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6543.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:880
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 1648
          4⤵
          • Program crash
          PID:2012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471762.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471762.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1548
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1472 -ip 1472
    1⤵
      PID:1828
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 880 -ip 880
      1⤵
        PID:1416

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471762.exe

        Filesize

        175KB

        MD5

        a066de2e4e1d5397faf32cf7bae07568

        SHA1

        495b0cde56b4ec47e6efe00b6297fd6004edcd19

        SHA256

        c80b38ceb00f9f35099fbbd4db0ccc0bd75531a363727e0fd435f984e93f7b9a

        SHA512

        2a929343bf1d6a842e649f29f410337bf276d5e8edc65fc49903ac2166ef27c9d259685eb81b94d3ebae6cf67a45fc4283e661a7a6e287458b42e4a814cf0902

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si471762.exe

        Filesize

        175KB

        MD5

        a066de2e4e1d5397faf32cf7bae07568

        SHA1

        495b0cde56b4ec47e6efe00b6297fd6004edcd19

        SHA256

        c80b38ceb00f9f35099fbbd4db0ccc0bd75531a363727e0fd435f984e93f7b9a

        SHA512

        2a929343bf1d6a842e649f29f410337bf276d5e8edc65fc49903ac2166ef27c9d259685eb81b94d3ebae6cf67a45fc4283e661a7a6e287458b42e4a814cf0902

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un987548.exe

        Filesize

        548KB

        MD5

        f0772aac6c5e536b33fec0f3420dface

        SHA1

        87e37c9f02b5e8d9c7bcb4ad5dcf1d56efe3514c

        SHA256

        3a1a9bd1ec953dbdc8ba3dcad9d65a29d847a1b278ddf2b78b5e38e5f311dc48

        SHA512

        fc3bef94001e3a2c133434a476ee2e721b9d2ad12027f0c984c0599ed69a9549dadfe1d5e2024ab518e21edaea0a65cdb74e0ad55cbb4e038442c786e63f8b8e

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un987548.exe

        Filesize

        548KB

        MD5

        f0772aac6c5e536b33fec0f3420dface

        SHA1

        87e37c9f02b5e8d9c7bcb4ad5dcf1d56efe3514c

        SHA256

        3a1a9bd1ec953dbdc8ba3dcad9d65a29d847a1b278ddf2b78b5e38e5f311dc48

        SHA512

        fc3bef94001e3a2c133434a476ee2e721b9d2ad12027f0c984c0599ed69a9549dadfe1d5e2024ab518e21edaea0a65cdb74e0ad55cbb4e038442c786e63f8b8e

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0335.exe

        Filesize

        291KB

        MD5

        f88b6c79e6fcd40a39dcb21800e44be5

        SHA1

        3a9fa921e136d4bed673e575ee3bcad80300aaec

        SHA256

        7d8fc961315e97acea724fafe7be0895306ba7e09f6cbda04902eb3fed789168

        SHA512

        78b2b4a31315539e6a59f6db946412100ca7e6b237cf1d1724982e6c8b2bfb7b9c6042ea2a88980b8cd5248650ec402afc399d062c931dd10a2dbd5613b9ad65

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0335.exe

        Filesize

        291KB

        MD5

        f88b6c79e6fcd40a39dcb21800e44be5

        SHA1

        3a9fa921e136d4bed673e575ee3bcad80300aaec

        SHA256

        7d8fc961315e97acea724fafe7be0895306ba7e09f6cbda04902eb3fed789168

        SHA512

        78b2b4a31315539e6a59f6db946412100ca7e6b237cf1d1724982e6c8b2bfb7b9c6042ea2a88980b8cd5248650ec402afc399d062c931dd10a2dbd5613b9ad65

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6543.exe

        Filesize

        345KB

        MD5

        b8d898fe703585694b5cc7706599c548

        SHA1

        b5e87f4fb50c0140bc3ec25ce66cf4c53c51f33d

        SHA256

        f137149a7e817d89e6b994fe3b7dcc2deac86d442d5f905ccf491ad715697b6d

        SHA512

        f349b1adcce2a38c0cc8879c78fdddc8859b85f4a295eccfcc133308a4c2319cc58ce9175ce90dd3e2b6c0c2ca1b66ec9004f77d9a33d7f4a1bf90e2fa7f30b6

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu6543.exe

        Filesize

        345KB

        MD5

        b8d898fe703585694b5cc7706599c548

        SHA1

        b5e87f4fb50c0140bc3ec25ce66cf4c53c51f33d

        SHA256

        f137149a7e817d89e6b994fe3b7dcc2deac86d442d5f905ccf491ad715697b6d

        SHA512

        f349b1adcce2a38c0cc8879c78fdddc8859b85f4a295eccfcc133308a4c2319cc58ce9175ce90dd3e2b6c0c2ca1b66ec9004f77d9a33d7f4a1bf90e2fa7f30b6

      • memory/880-1099-0x0000000006730000-0x0000000006D48000-memory.dmp

        Filesize

        6.1MB

      • memory/880-1102-0x0000000006F30000-0x0000000006F6C000-memory.dmp

        Filesize

        240KB

      • memory/880-1114-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-1113-0x00000000083F0000-0x0000000008440000-memory.dmp

        Filesize

        320KB

      • memory/880-1112-0x0000000008370000-0x00000000083E6000-memory.dmp

        Filesize

        472KB

      • memory/880-1111-0x0000000007BC0000-0x00000000080EC000-memory.dmp

        Filesize

        5.2MB

      • memory/880-1110-0x00000000079E0000-0x0000000007BA2000-memory.dmp

        Filesize

        1.8MB

      • memory/880-1109-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-1108-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-1107-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-1105-0x00000000072C0000-0x0000000007326000-memory.dmp

        Filesize

        408KB

      • memory/880-1104-0x0000000007220000-0x00000000072B2000-memory.dmp

        Filesize

        584KB

      • memory/880-1103-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-1101-0x0000000006F10000-0x0000000006F22000-memory.dmp

        Filesize

        72KB

      • memory/880-1100-0x0000000006DD0000-0x0000000006EDA000-memory.dmp

        Filesize

        1.0MB

      • memory/880-226-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-224-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-222-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-220-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-218-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-216-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-189-0x0000000003400000-0x000000000344B000-memory.dmp

        Filesize

        300KB

      • memory/880-191-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-190-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-192-0x0000000005EA0000-0x0000000005EB0000-memory.dmp

        Filesize

        64KB

      • memory/880-193-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-194-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-196-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-198-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-200-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-202-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-204-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-206-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-208-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-210-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-212-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/880-214-0x00000000066E0000-0x000000000671F000-memory.dmp

        Filesize

        252KB

      • memory/1472-171-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-148-0x0000000000720000-0x000000000074D000-memory.dmp

        Filesize

        180KB

      • memory/1472-184-0x0000000000400000-0x000000000070B000-memory.dmp

        Filesize

        3.0MB

      • memory/1472-182-0x0000000004D10000-0x0000000004D20000-memory.dmp

        Filesize

        64KB

      • memory/1472-181-0x0000000004D10000-0x0000000004D20000-memory.dmp

        Filesize

        64KB

      • memory/1472-180-0x0000000000400000-0x000000000070B000-memory.dmp

        Filesize

        3.0MB

      • memory/1472-151-0x0000000004D10000-0x0000000004D20000-memory.dmp

        Filesize

        64KB

      • memory/1472-177-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-179-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-153-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-175-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-173-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-152-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-149-0x0000000004D10000-0x0000000004D20000-memory.dmp

        Filesize

        64KB

      • memory/1472-159-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-165-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-163-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-161-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-167-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-157-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-155-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1472-150-0x0000000004D20000-0x00000000052C4000-memory.dmp

        Filesize

        5.6MB

      • memory/1472-169-0x0000000004C70000-0x0000000004C82000-memory.dmp

        Filesize

        72KB

      • memory/1548-1120-0x0000000000030000-0x0000000000062000-memory.dmp

        Filesize

        200KB

      • memory/1548-1121-0x0000000004C50000-0x0000000004C60000-memory.dmp

        Filesize

        64KB

      • memory/1548-1122-0x0000000004C50000-0x0000000004C60000-memory.dmp

        Filesize

        64KB