Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2023, 10:05

General

  • Target

    02655d17dcbd045b41f82f47d2a4adb5af1dc15702339d2ee9c4ed46506d7751.exe

  • Size

    684KB

  • MD5

    a819bafc5390a88982cc79b2dbe64d50

  • SHA1

    9a547483c3000c110202348e30b1f16457ffce02

  • SHA256

    02655d17dcbd045b41f82f47d2a4adb5af1dc15702339d2ee9c4ed46506d7751

  • SHA512

    77697b288a24f0b42b4bd768bf12fba8d96a66c028572a7f21b9b2bf9062b07f833ce417b385f825149563e47adc00deba386a3588bafa3b89423eedf227823a

  • SSDEEP

    12288:NMroy90zKAuMrT+UYu5vO88FbPFw2XY6ZV8wJhMl2kC6BllAFJKBuCVK:tyVMraUYu5GR3wAOwJhOConAUTK

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

muse

C2

176.113.115.145:4125

Attributes
  • auth_value

    b91988a63a24940038d9262827a5320c

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\02655d17dcbd045b41f82f47d2a4adb5af1dc15702339d2ee9c4ed46506d7751.exe
    "C:\Users\Admin\AppData\Local\Temp\02655d17dcbd045b41f82f47d2a4adb5af1dc15702339d2ee9c4ed46506d7751.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un366041.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un366041.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1576
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4201.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4201.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4592
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 1088
          4⤵
          • Program crash
          PID:920
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4181.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4181.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4788
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4788 -s 1628
          4⤵
          • Program crash
          PID:4068
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489285.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489285.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2116
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4592 -ip 4592
    1⤵
      PID:1324
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4788 -ip 4788
      1⤵
        PID:3232

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489285.exe

        Filesize

        175KB

        MD5

        2ae7f2181c0ef014a310ebc416c6a534

        SHA1

        2d8976f2b3303f880b01f3400d987a3962948da2

        SHA256

        2ce6ab43cbdf79272a707fceca56a189ff8ff3f5c66fcba5adf6ea33ed210143

        SHA512

        2e3690ed849729af4901c7a08cfe3e1fde7078dc26f2ba72407fbf84bb6cc9198132efb293e7249a65307d602e019c83cad1a26e6e1dbb55771506331d3b6994

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si489285.exe

        Filesize

        175KB

        MD5

        2ae7f2181c0ef014a310ebc416c6a534

        SHA1

        2d8976f2b3303f880b01f3400d987a3962948da2

        SHA256

        2ce6ab43cbdf79272a707fceca56a189ff8ff3f5c66fcba5adf6ea33ed210143

        SHA512

        2e3690ed849729af4901c7a08cfe3e1fde7078dc26f2ba72407fbf84bb6cc9198132efb293e7249a65307d602e019c83cad1a26e6e1dbb55771506331d3b6994

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un366041.exe

        Filesize

        542KB

        MD5

        9e1c86576efaf209f669106e1cc7963c

        SHA1

        2e7c2ed12b4e07288fa9b006c0169faadc49e3d7

        SHA256

        432c76f9a34507cec4562ccc770ba202c257db6d7ce43206eddd9a7e745e11b8

        SHA512

        e7e2e3d581a2572cac748c941f027466c244adf17a263ee14947756919d7c2da1850c3bd0d0b7af66c251559b8e54efae16b83036dd589ee12952a3328a84db6

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un366041.exe

        Filesize

        542KB

        MD5

        9e1c86576efaf209f669106e1cc7963c

        SHA1

        2e7c2ed12b4e07288fa9b006c0169faadc49e3d7

        SHA256

        432c76f9a34507cec4562ccc770ba202c257db6d7ce43206eddd9a7e745e11b8

        SHA512

        e7e2e3d581a2572cac748c941f027466c244adf17a263ee14947756919d7c2da1850c3bd0d0b7af66c251559b8e54efae16b83036dd589ee12952a3328a84db6

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4201.exe

        Filesize

        322KB

        MD5

        0909487eb1f712239276f5256df2162e

        SHA1

        f3b253cb1e9c84d2749c93f8efb8934ff8d8c4e4

        SHA256

        7ec93ca1c652d4e09c8080400f8c6537ad8af4b7dc1dc5b828211783cb1e17bd

        SHA512

        e6bfe324f72e62142c830f3142b0ae0138c9b397d92935bb865d2467d051c3c4434fd030ce622189cbaee824e671f38efaabdffba9c25c40ebc9b329a0374171

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro4201.exe

        Filesize

        322KB

        MD5

        0909487eb1f712239276f5256df2162e

        SHA1

        f3b253cb1e9c84d2749c93f8efb8934ff8d8c4e4

        SHA256

        7ec93ca1c652d4e09c8080400f8c6537ad8af4b7dc1dc5b828211783cb1e17bd

        SHA512

        e6bfe324f72e62142c830f3142b0ae0138c9b397d92935bb865d2467d051c3c4434fd030ce622189cbaee824e671f38efaabdffba9c25c40ebc9b329a0374171

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4181.exe

        Filesize

        380KB

        MD5

        2559862404418fd57172630c8569dc65

        SHA1

        b3fd81a89d8fcfb98575509eb2381a3b413cbc42

        SHA256

        378b85e52544afafaf9fda774cbbd4cf1be148e493325b8fd25a161634d17c14

        SHA512

        369850c848371517513c7a36e0a2715c74110af8c856afae33a1a1e4411aefd40fd347b4ca14c7d72217f5d92fd5fbb3121e951c8f58f6b772d3fe0458cac6b8

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4181.exe

        Filesize

        380KB

        MD5

        2559862404418fd57172630c8569dc65

        SHA1

        b3fd81a89d8fcfb98575509eb2381a3b413cbc42

        SHA256

        378b85e52544afafaf9fda774cbbd4cf1be148e493325b8fd25a161634d17c14

        SHA512

        369850c848371517513c7a36e0a2715c74110af8c856afae33a1a1e4411aefd40fd347b4ca14c7d72217f5d92fd5fbb3121e951c8f58f6b772d3fe0458cac6b8

      • memory/2116-1122-0x0000000000C50000-0x0000000000C82000-memory.dmp

        Filesize

        200KB

      • memory/2116-1123-0x00000000055D0000-0x00000000055E0000-memory.dmp

        Filesize

        64KB

      • memory/4592-163-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-177-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-155-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-157-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-159-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-161-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-151-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-165-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-167-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-169-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-171-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-173-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-175-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-153-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-178-0x0000000002B80000-0x0000000002BAD000-memory.dmp

        Filesize

        180KB

      • memory/4592-180-0x0000000004980000-0x0000000004990000-memory.dmp

        Filesize

        64KB

      • memory/4592-179-0x0000000004980000-0x0000000004990000-memory.dmp

        Filesize

        64KB

      • memory/4592-181-0x0000000004980000-0x0000000004990000-memory.dmp

        Filesize

        64KB

      • memory/4592-182-0x0000000000400000-0x0000000002B7E000-memory.dmp

        Filesize

        39.5MB

      • memory/4592-183-0x0000000004980000-0x0000000004990000-memory.dmp

        Filesize

        64KB

      • memory/4592-184-0x0000000004980000-0x0000000004990000-memory.dmp

        Filesize

        64KB

      • memory/4592-186-0x0000000004980000-0x0000000004990000-memory.dmp

        Filesize

        64KB

      • memory/4592-187-0x0000000000400000-0x0000000002B7E000-memory.dmp

        Filesize

        39.5MB

      • memory/4592-150-0x0000000004960000-0x0000000004972000-memory.dmp

        Filesize

        72KB

      • memory/4592-149-0x0000000007230000-0x00000000077D4000-memory.dmp

        Filesize

        5.6MB

      • memory/4788-194-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-225-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-195-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-193-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-199-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-201-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-203-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-205-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-207-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-209-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-211-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-213-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-215-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-217-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-219-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-221-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-223-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-196-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-227-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-229-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-1102-0x00000000078D0000-0x0000000007EE8000-memory.dmp

        Filesize

        6.1MB

      • memory/4788-1103-0x0000000007F70000-0x000000000807A000-memory.dmp

        Filesize

        1.0MB

      • memory/4788-1104-0x00000000080B0000-0x00000000080C2000-memory.dmp

        Filesize

        72KB

      • memory/4788-1105-0x00000000080D0000-0x000000000810C000-memory.dmp

        Filesize

        240KB

      • memory/4788-1106-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-1108-0x00000000083C0000-0x0000000008452000-memory.dmp

        Filesize

        584KB

      • memory/4788-1109-0x0000000008460000-0x00000000084C6000-memory.dmp

        Filesize

        408KB

      • memory/4788-1110-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-1111-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-1112-0x0000000008B90000-0x0000000008D52000-memory.dmp

        Filesize

        1.8MB

      • memory/4788-1113-0x0000000008D60000-0x000000000928C000-memory.dmp

        Filesize

        5.2MB

      • memory/4788-1114-0x0000000007130000-0x0000000007140000-memory.dmp

        Filesize

        64KB

      • memory/4788-197-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/4788-192-0x0000000002C70000-0x0000000002CBB000-memory.dmp

        Filesize

        300KB

      • memory/4788-1115-0x0000000009600000-0x0000000009676000-memory.dmp

        Filesize

        472KB

      • memory/4788-1116-0x0000000009690000-0x00000000096E0000-memory.dmp

        Filesize

        320KB