Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    109s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2023, 16:15

General

  • Target

    b913a70734dfebc863df8642e6614ad14e8d23b92b6489fa28c3cef017b986f8.exe

  • Size

    695KB

  • MD5

    c5857ed4b98fe7ecc7a5e363a23f0779

  • SHA1

    96221d810e2d26b35c0ebb3548d1b00a9978e1fa

  • SHA256

    b913a70734dfebc863df8642e6614ad14e8d23b92b6489fa28c3cef017b986f8

  • SHA512

    11b5c57a865b1beb54298f94d006e76d0bc30b07d9c7296b6d0ae3508c2a0ce12fef826e610aaf3d186a1b68d755d7f444cbe99bdc06652d137294689603e3d2

  • SSDEEP

    12288:XMr8y90C5SieimwJjZMmKD6aDzanzpcqdt9izYVj4QZlICiH1LS:/yd5j/MmKD6OOnNc0y0SQFx

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

muse

C2

176.113.115.145:4125

Attributes
  • auth_value

    b91988a63a24940038d9262827a5320c

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b913a70734dfebc863df8642e6614ad14e8d23b92b6489fa28c3cef017b986f8.exe
    "C:\Users\Admin\AppData\Local\Temp\b913a70734dfebc863df8642e6614ad14e8d23b92b6489fa28c3cef017b986f8.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4964
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un836402.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un836402.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4140
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0935.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0935.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1080
          4⤵
          • Program crash
          PID:180
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9480.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9480.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3112
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 1348
          4⤵
          • Program crash
          PID:5096
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328782.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328782.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1096
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4736 -ip 4736
    1⤵
      PID:4940
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3112 -ip 3112
      1⤵
        PID:5064

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328782.exe

        Filesize

        175KB

        MD5

        f41a3224ad6fde83c83a30b541489b92

        SHA1

        17bfce2734911b375445e4ba874c2e46e4b5a162

        SHA256

        65bf0e8ab802a900e56979da730ba1bee0db1485b6a4a9c230fb8407ef499911

        SHA512

        cadaa338903f8be7cd782cbcbe707caccb13bc2173e44cb60dc9b4de628662fa0442aa84fed4e58fdce4f7d9428f05e6cca995968c2a576309623be33cbea7fd

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328782.exe

        Filesize

        175KB

        MD5

        f41a3224ad6fde83c83a30b541489b92

        SHA1

        17bfce2734911b375445e4ba874c2e46e4b5a162

        SHA256

        65bf0e8ab802a900e56979da730ba1bee0db1485b6a4a9c230fb8407ef499911

        SHA512

        cadaa338903f8be7cd782cbcbe707caccb13bc2173e44cb60dc9b4de628662fa0442aa84fed4e58fdce4f7d9428f05e6cca995968c2a576309623be33cbea7fd

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un836402.exe

        Filesize

        553KB

        MD5

        3f36a71cdca74c1c0bd28e38411707fc

        SHA1

        59d4e99395d610718b5433631aa03a5edfd2051d

        SHA256

        4c86e58ab46b4b061a6072cbf0f39cf160853c08af2989bc3183fa3e899d2d54

        SHA512

        86d8a34129736092cdfdc563ee2bb3cb05f22a2c27d1ae23e87b0339f574fecc7d679bed503732c66e419127d47afd1027cba571f8ec961523f4cf6b9efed45c

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un836402.exe

        Filesize

        553KB

        MD5

        3f36a71cdca74c1c0bd28e38411707fc

        SHA1

        59d4e99395d610718b5433631aa03a5edfd2051d

        SHA256

        4c86e58ab46b4b061a6072cbf0f39cf160853c08af2989bc3183fa3e899d2d54

        SHA512

        86d8a34129736092cdfdc563ee2bb3cb05f22a2c27d1ae23e87b0339f574fecc7d679bed503732c66e419127d47afd1027cba571f8ec961523f4cf6b9efed45c

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0935.exe

        Filesize

        347KB

        MD5

        4d1ab97f495621539aa5d549ddfecd61

        SHA1

        c2318418fe90511da1d66ce5845ad14685279322

        SHA256

        d5ade8d1a22db0e2728f0f1e467107048a134c5cfeae92878db095af129a63ca

        SHA512

        2f43b0d2be4eaf015879b553926035c1b71782bd2069c9e627f2525f23e00644cc6073991c848e4e89103d983edec5009ae57b647231b54908df1f1759d573f4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0935.exe

        Filesize

        347KB

        MD5

        4d1ab97f495621539aa5d549ddfecd61

        SHA1

        c2318418fe90511da1d66ce5845ad14685279322

        SHA256

        d5ade8d1a22db0e2728f0f1e467107048a134c5cfeae92878db095af129a63ca

        SHA512

        2f43b0d2be4eaf015879b553926035c1b71782bd2069c9e627f2525f23e00644cc6073991c848e4e89103d983edec5009ae57b647231b54908df1f1759d573f4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9480.exe

        Filesize

        405KB

        MD5

        ccbdf6d63f115198566ee3061c6d295f

        SHA1

        790cd32f91e6e215bce065b3860e8186914892fe

        SHA256

        348874ef9e7dd30be1542bacddb168e8b46c9192530fe6969a0fb7e569f9c591

        SHA512

        ab01c64135a3bcc162635faf2a05837dfe0e9a894431a2b94bb3ebf32b52f241f5e6ed72ed8b684651b66431caf0db3974f1f06e192519ee7d84ac58f4d29cda

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu9480.exe

        Filesize

        405KB

        MD5

        ccbdf6d63f115198566ee3061c6d295f

        SHA1

        790cd32f91e6e215bce065b3860e8186914892fe

        SHA256

        348874ef9e7dd30be1542bacddb168e8b46c9192530fe6969a0fb7e569f9c591

        SHA512

        ab01c64135a3bcc162635faf2a05837dfe0e9a894431a2b94bb3ebf32b52f241f5e6ed72ed8b684651b66431caf0db3974f1f06e192519ee7d84ac58f4d29cda

      • memory/1096-1123-0x0000000004B70000-0x0000000004B80000-memory.dmp

        Filesize

        64KB

      • memory/1096-1122-0x0000000000260000-0x0000000000292000-memory.dmp

        Filesize

        200KB

      • memory/3112-1102-0x0000000007F80000-0x000000000808A000-memory.dmp

        Filesize

        1.0MB

      • memory/3112-1104-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-1116-0x0000000009560000-0x00000000095B0000-memory.dmp

        Filesize

        320KB

      • memory/3112-1115-0x00000000094E0000-0x0000000009556000-memory.dmp

        Filesize

        472KB

      • memory/3112-1114-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-1113-0x0000000008D60000-0x000000000928C000-memory.dmp

        Filesize

        5.2MB

      • memory/3112-1112-0x0000000008B90000-0x0000000008D52000-memory.dmp

        Filesize

        1.8MB

      • memory/3112-1111-0x0000000008470000-0x00000000084D6000-memory.dmp

        Filesize

        408KB

      • memory/3112-1110-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-1109-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-1108-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-1107-0x00000000083D0000-0x0000000008462000-memory.dmp

        Filesize

        584KB

      • memory/3112-1105-0x00000000080E0000-0x000000000811C000-memory.dmp

        Filesize

        240KB

      • memory/3112-1103-0x00000000080C0000-0x00000000080D2000-memory.dmp

        Filesize

        72KB

      • memory/3112-1101-0x00000000078E0000-0x0000000007EF8000-memory.dmp

        Filesize

        6.1MB

      • memory/3112-228-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-226-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-224-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-222-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-220-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-218-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-192-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-191-0x0000000004540000-0x000000000458B000-memory.dmp

        Filesize

        300KB

      • memory/3112-193-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-194-0x00000000049B0000-0x00000000049C0000-memory.dmp

        Filesize

        64KB

      • memory/3112-195-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-196-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-198-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-200-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-202-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-204-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-206-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-208-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-210-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-212-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-214-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/3112-216-0x0000000007700000-0x000000000773F000-memory.dmp

        Filesize

        252KB

      • memory/4736-174-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-152-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-186-0x0000000000400000-0x0000000002B84000-memory.dmp

        Filesize

        39.5MB

      • memory/4736-185-0x0000000007360000-0x0000000007370000-memory.dmp

        Filesize

        64KB

      • memory/4736-184-0x0000000007360000-0x0000000007370000-memory.dmp

        Filesize

        64KB

      • memory/4736-183-0x0000000007360000-0x0000000007370000-memory.dmp

        Filesize

        64KB

      • memory/4736-181-0x0000000000400000-0x0000000002B84000-memory.dmp

        Filesize

        39.5MB

      • memory/4736-154-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-180-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-160-0x0000000007360000-0x0000000007370000-memory.dmp

        Filesize

        64KB

      • memory/4736-178-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-176-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-157-0x0000000007360000-0x0000000007370000-memory.dmp

        Filesize

        64KB

      • memory/4736-170-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-156-0x0000000002CA0000-0x0000000002CCD000-memory.dmp

        Filesize

        180KB

      • memory/4736-168-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-166-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-164-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-158-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-159-0x0000000007360000-0x0000000007370000-memory.dmp

        Filesize

        64KB

      • memory/4736-162-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-172-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-150-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-149-0x0000000004C40000-0x0000000004C52000-memory.dmp

        Filesize

        72KB

      • memory/4736-148-0x0000000007370000-0x0000000007914000-memory.dmp

        Filesize

        5.6MB