Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
31/03/2023, 21:02 UTC
General
-
Target
7aaee224559608d8c305b6016b0461200dc88758ef46374b1eb3df3a8cc6114d.exe
-
Size
533KB
-
MD5
6686c2e73f606bb17d692fe1219f10f0
-
SHA1
2cedfceb62c28cea0792af906ef6a4311a18cd04
-
SHA256
7aaee224559608d8c305b6016b0461200dc88758ef46374b1eb3df3a8cc6114d
-
SHA512
b55620234bb0d4a4510c0482ed174820693175e6d680d93bdab8a8c010c5fd1d7309e8820ecbd94fd8b15cb86e366a9a8f6f9c1d480a1727fc6221e727742b30
-
SSDEEP
12288:eMrCy90PPR0CiCK4P7Q97PIzR653LqwBddzsOPrWg64:oysPBK4jQ9Li653GG/vrWq
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
-
Executes dropped EXE 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 1 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aaee224559608d8c305b6016b0461200dc88758ef46374b1eb3df3a8cc6114d.exe"C:\Users\Admin\AppData\Local\Temp\7aaee224559608d8c305b6016b0461200dc88758ef46374b1eb3df3a8cc6114d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWb3664.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziWb3664.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr487695.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr487695.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku927546.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku927546.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4840 -s 13484⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr315463.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr315463.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4840 -ip 48401⤵
Network
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse -
DNS126.111.238.8.in-addr.arpaRemote address:8.8.8.8:53Request126.111.238.8.in-addr.arpaIN PTRResponse
-
DNS36.146.190.20.in-addr.arpaRemote address:8.8.8.8:53Request36.146.190.20.in-addr.arpaIN PTRResponse36.146.190.20.in-addr.arpaIN CNAME36.0-26.146.190.20.in-addr.arpa
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS145.115.113.176.in-addr.arpaRemote address:8.8.8.8:53Request145.115.113.176.in-addr.arpaIN PTRResponse
-
DNS64.13.109.52.in-addr.arpaRemote address:8.8.8.8:53Request64.13.109.52.in-addr.arpaIN PTRResponse
-
DNS5.233.140.95.in-addr.arpaRemote address:8.8.8.8:53Request5.233.140.95.in-addr.arpaIN PTRResponse5.233.140.95.in-addr.arpaIN PTRhttps-95-140-233-5amsllnwnet
-
176.113.115.145:4125 -
176.113.115.145:4125
-
20.189.173.9:443
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53126.111.238.8.in-addr.arpadns
DNS Request
126.111.238.8.in-addr.arpa
-
8.8.8.8:5336.146.190.20.in-addr.arpadns
DNS Request
36.146.190.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53145.115.113.176.in-addr.arpadns
DNS Request
145.115.113.176.in-addr.arpa
-
8.8.8.8:5364.13.109.52.in-addr.arpadns
DNS Request
64.13.109.52.in-addr.arpa
-
8.8.8.8:535.233.140.95.in-addr.arpadns
DNS Request
5.233.140.95.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5e296c470a14209b5ed35f67780c9a586
SHA1d7d51ad92212804096ff31781c8a28d969258e28
SHA256e471d6a736b6356705b5273b8db720402bf65fdf32ec5ddc08479d9969da0e62
SHA512376597f830b79326634fbc17fe8d8ef2fb9afddea0f9407d749c1568a851fd9b38c516e2abd212469b2c08f52ed870fe4be079d4ee212e86bb6512f3356effe7
-
Filesize
175KB
MD5e296c470a14209b5ed35f67780c9a586
SHA1d7d51ad92212804096ff31781c8a28d969258e28
SHA256e471d6a736b6356705b5273b8db720402bf65fdf32ec5ddc08479d9969da0e62
SHA512376597f830b79326634fbc17fe8d8ef2fb9afddea0f9407d749c1568a851fd9b38c516e2abd212469b2c08f52ed870fe4be079d4ee212e86bb6512f3356effe7
-
Filesize
391KB
MD56d1cb76a0364ca403f7950753cb668ea
SHA16b8c94e21e1a4345631cff0516901c2c7ca5b316
SHA25649cf88f11e3daac0b51ad460713ec8cd51a6baff29f98f8027783d1643f6f9a6
SHA512536125e3a8c08536fc08dfeee48b8084e7d9af881aa648d498296914564e339af75763882022f49ac4f0488c2f653e4d97d0f933a1c4ebfcec77935a83419d5d
-
Filesize
391KB
MD56d1cb76a0364ca403f7950753cb668ea
SHA16b8c94e21e1a4345631cff0516901c2c7ca5b316
SHA25649cf88f11e3daac0b51ad460713ec8cd51a6baff29f98f8027783d1643f6f9a6
SHA512536125e3a8c08536fc08dfeee48b8084e7d9af881aa648d498296914564e339af75763882022f49ac4f0488c2f653e4d97d0f933a1c4ebfcec77935a83419d5d
-
Filesize
11KB
MD54f171a52eb12a56f75d60ce240a5af34
SHA190eea52aa1092c72d830e429b5fc62861ee56ee7
SHA2561fde1b55ee728d8e26797421ea16256d25f454ac7e8fc891b064bec9941bd92f
SHA512694109eb6259e31777461f1d58b47dce56ab3e18586e51ce0034452f31d2f0becc39784fabe16bd9e30020fc94914bfb7c3634e7bd77e7bfe19c05671ab08189
-
Filesize
11KB
MD54f171a52eb12a56f75d60ce240a5af34
SHA190eea52aa1092c72d830e429b5fc62861ee56ee7
SHA2561fde1b55ee728d8e26797421ea16256d25f454ac7e8fc891b064bec9941bd92f
SHA512694109eb6259e31777461f1d58b47dce56ab3e18586e51ce0034452f31d2f0becc39784fabe16bd9e30020fc94914bfb7c3634e7bd77e7bfe19c05671ab08189
-
Filesize
359KB
MD58ff62cce9015fec02ae09d51e23ab46a
SHA1d16a50ad6a8cc7736f576a0e08620eeb3c96aeee
SHA256667748899d945da6d5becf3fe47d6e35a59a22636616b0040dd23c7d5961409c
SHA512e328de5da07c76d7ecb96cd8384119a2b4c83f317a7504ae852bce17e769b7e999ab72c196c89293c1a7475d0515aa11334adff48e3206f9002b92a1b33ace17
-
Filesize
359KB
MD58ff62cce9015fec02ae09d51e23ab46a
SHA1d16a50ad6a8cc7736f576a0e08620eeb3c96aeee
SHA256667748899d945da6d5becf3fe47d6e35a59a22636616b0040dd23c7d5961409c
SHA512e328de5da07c76d7ecb96cd8384119a2b4c83f317a7504ae852bce17e769b7e999ab72c196c89293c1a7475d0515aa11334adff48e3206f9002b92a1b33ace17
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
300KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
64KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
320KB
-
Filesize
1.8MB
-
Filesize
5.2MB