Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2023, 05:35
Static task
static1
Behavioral task
behavioral1
Sample
f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe
Resource
win10v2004-20230220-en
General
-
Target
f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe
-
Size
534KB
-
MD5
6b9810c100d9f90aafb304f3d65fe90a
-
SHA1
dbb068d9c2912d488ad1da2d0e1c57d11e01a85f
-
SHA256
f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610
-
SHA512
c658d13fd780ff9c416d72f8f3e86a598f4a49e039b722b561acfd410d113644d153a6941ea808e976817a1cee90d061351f209b33a53d216220084608e7bbfa
-
SSDEEP
12288:tMrzy90WJ6yWtYGYJf9bgjTPK25SH2zSbBWAnYIzoz4RKIj:qyfotlUcjTPW2z6BDYw/
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
spora
176.113.115.145:4125
-
auth_value
441b39ab37774b2ca9931c31e1bc6071
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr186041.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr186041.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr186041.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr186041.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr186041.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr186041.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 32 IoCs
resource yara_rule behavioral1/memory/1856-158-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-159-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-161-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-163-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-165-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-167-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-169-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-171-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-173-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-175-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-177-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-179-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-181-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-183-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-189-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-186-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-191-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-193-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-195-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-197-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-199-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-201-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-203-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-205-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-207-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-209-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-211-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-213-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-215-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-217-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-219-0x0000000002640000-0x000000000267F000-memory.dmp family_redline behavioral1/memory/1856-221-0x0000000002640000-0x000000000267F000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 1592 ziKt9271.exe 4228 jr186041.exe 1856 ku233209.exe 4996 lr678895.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr186041.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziKt9271.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziKt9271.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4976 1856 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4228 jr186041.exe 4228 jr186041.exe 1856 ku233209.exe 1856 ku233209.exe 4996 lr678895.exe 4996 lr678895.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4228 jr186041.exe Token: SeDebugPrivilege 1856 ku233209.exe Token: SeDebugPrivilege 4996 lr678895.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3384 wrote to memory of 1592 3384 f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe 83 PID 3384 wrote to memory of 1592 3384 f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe 83 PID 3384 wrote to memory of 1592 3384 f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe 83 PID 1592 wrote to memory of 4228 1592 ziKt9271.exe 84 PID 1592 wrote to memory of 4228 1592 ziKt9271.exe 84 PID 1592 wrote to memory of 1856 1592 ziKt9271.exe 85 PID 1592 wrote to memory of 1856 1592 ziKt9271.exe 85 PID 1592 wrote to memory of 1856 1592 ziKt9271.exe 85 PID 3384 wrote to memory of 4996 3384 f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe 89 PID 3384 wrote to memory of 4996 3384 f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe 89 PID 3384 wrote to memory of 4996 3384 f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe"C:\Users\Admin\AppData\Local\Temp\f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKt9271.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKt9271.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr186041.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr186041.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku233209.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku233209.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 17804⤵
- Program crash
PID:4976
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr678895.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr678895.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1856 -ip 18561⤵PID:2836
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD5e235498dcd7c566d258698969981dcb2
SHA13971abe1f8e3e6ec8da7dfb707d282c49f8c2e73
SHA25617879022f0a8035b14e1cef17f3288f89ef05d0ab5715bb2b0c71af476525efa
SHA51275c2c72ca1a7191c1c0a925e8ae09f77ad356d7d2c500173f17ba1bb0400a155d0b0ce4dd6f5829f7156d30d1798ddf99c89df80cf61ed86836ea200876defe0
-
Filesize
176KB
MD5e235498dcd7c566d258698969981dcb2
SHA13971abe1f8e3e6ec8da7dfb707d282c49f8c2e73
SHA25617879022f0a8035b14e1cef17f3288f89ef05d0ab5715bb2b0c71af476525efa
SHA51275c2c72ca1a7191c1c0a925e8ae09f77ad356d7d2c500173f17ba1bb0400a155d0b0ce4dd6f5829f7156d30d1798ddf99c89df80cf61ed86836ea200876defe0
-
Filesize
392KB
MD5eb465dd9f5592eda53422459ab376e0b
SHA1d1d0dccefb9c8f005ae669eea61342d738f1df13
SHA256bc5ebd7c18294413cb11073eeadc20cea2a46d3f95c6f45c61d096cf5e38ce02
SHA512a14b565f1e1641a7164fc3ebdd8e3bd56ed3ff9d637aa5070ce651f6bc7114134acff1ba692bee38a8b8545f4d20325e284f22284a845c30c6ecb4ac6ace5339
-
Filesize
392KB
MD5eb465dd9f5592eda53422459ab376e0b
SHA1d1d0dccefb9c8f005ae669eea61342d738f1df13
SHA256bc5ebd7c18294413cb11073eeadc20cea2a46d3f95c6f45c61d096cf5e38ce02
SHA512a14b565f1e1641a7164fc3ebdd8e3bd56ed3ff9d637aa5070ce651f6bc7114134acff1ba692bee38a8b8545f4d20325e284f22284a845c30c6ecb4ac6ace5339
-
Filesize
12KB
MD59e74e103e534655b21355b299da19c75
SHA141f866ed16a04f8fdd40f7bf181186a37f00d4e4
SHA256c9665c707e189d3905e494fa7800656a71addf9ca7fecba26c79d4875889258d
SHA51288d4dcc96e7ad95593e16454dfcd1cbbdf84c05c96268fb68dd8461c982e8a0d05c811114a95559b45c330b98ea14240d61aff9526508e65c8c0b20e2a83945e
-
Filesize
12KB
MD59e74e103e534655b21355b299da19c75
SHA141f866ed16a04f8fdd40f7bf181186a37f00d4e4
SHA256c9665c707e189d3905e494fa7800656a71addf9ca7fecba26c79d4875889258d
SHA51288d4dcc96e7ad95593e16454dfcd1cbbdf84c05c96268fb68dd8461c982e8a0d05c811114a95559b45c330b98ea14240d61aff9526508e65c8c0b20e2a83945e
-
Filesize
319KB
MD51d0fb81496e394c6702161d4b01d3e06
SHA19d67c2855bee10cca05d29625ecf1525b90a006c
SHA2562be91c82a3a6c4daad6a81fb9ce38d618dae23f0550bfdc73e3ac74010e7ede2
SHA5120cb62ecca438a1a5471ca4e96727eb1fa18d93df903f89c622aab17d82be1c7abbfb9f6fb071033adc248837e1626d8bbb1ddb93fbea4b7bbc10d94450d9ac07
-
Filesize
319KB
MD51d0fb81496e394c6702161d4b01d3e06
SHA19d67c2855bee10cca05d29625ecf1525b90a006c
SHA2562be91c82a3a6c4daad6a81fb9ce38d618dae23f0550bfdc73e3ac74010e7ede2
SHA5120cb62ecca438a1a5471ca4e96727eb1fa18d93df903f89c622aab17d82be1c7abbfb9f6fb071033adc248837e1626d8bbb1ddb93fbea4b7bbc10d94450d9ac07