Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    91s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 05:35

General

  • Target

    f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe

  • Size

    534KB

  • MD5

    6b9810c100d9f90aafb304f3d65fe90a

  • SHA1

    dbb068d9c2912d488ad1da2d0e1c57d11e01a85f

  • SHA256

    f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610

  • SHA512

    c658d13fd780ff9c416d72f8f3e86a598f4a49e039b722b561acfd410d113644d153a6941ea808e976817a1cee90d061351f209b33a53d216220084608e7bbfa

  • SSDEEP

    12288:tMrzy90WJ6yWtYGYJf9bgjTPK25SH2zSbBWAnYIzoz4RKIj:qyfotlUcjTPW2z6BDYw/

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 32 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe
    "C:\Users\Admin\AppData\Local\Temp\f9fca9eedb464b2380cb77f5c4aaa23b6b44028114c8255b42b59392bdf78610.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKt9271.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKt9271.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr186041.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr186041.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4228
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku233209.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku233209.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1856
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 1780
          4⤵
          • Program crash
          PID:4976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr678895.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr678895.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4996
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1856 -ip 1856
    1⤵
      PID:2836

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr678895.exe

      Filesize

      176KB

      MD5

      e235498dcd7c566d258698969981dcb2

      SHA1

      3971abe1f8e3e6ec8da7dfb707d282c49f8c2e73

      SHA256

      17879022f0a8035b14e1cef17f3288f89ef05d0ab5715bb2b0c71af476525efa

      SHA512

      75c2c72ca1a7191c1c0a925e8ae09f77ad356d7d2c500173f17ba1bb0400a155d0b0ce4dd6f5829f7156d30d1798ddf99c89df80cf61ed86836ea200876defe0

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr678895.exe

      Filesize

      176KB

      MD5

      e235498dcd7c566d258698969981dcb2

      SHA1

      3971abe1f8e3e6ec8da7dfb707d282c49f8c2e73

      SHA256

      17879022f0a8035b14e1cef17f3288f89ef05d0ab5715bb2b0c71af476525efa

      SHA512

      75c2c72ca1a7191c1c0a925e8ae09f77ad356d7d2c500173f17ba1bb0400a155d0b0ce4dd6f5829f7156d30d1798ddf99c89df80cf61ed86836ea200876defe0

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKt9271.exe

      Filesize

      392KB

      MD5

      eb465dd9f5592eda53422459ab376e0b

      SHA1

      d1d0dccefb9c8f005ae669eea61342d738f1df13

      SHA256

      bc5ebd7c18294413cb11073eeadc20cea2a46d3f95c6f45c61d096cf5e38ce02

      SHA512

      a14b565f1e1641a7164fc3ebdd8e3bd56ed3ff9d637aa5070ce651f6bc7114134acff1ba692bee38a8b8545f4d20325e284f22284a845c30c6ecb4ac6ace5339

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKt9271.exe

      Filesize

      392KB

      MD5

      eb465dd9f5592eda53422459ab376e0b

      SHA1

      d1d0dccefb9c8f005ae669eea61342d738f1df13

      SHA256

      bc5ebd7c18294413cb11073eeadc20cea2a46d3f95c6f45c61d096cf5e38ce02

      SHA512

      a14b565f1e1641a7164fc3ebdd8e3bd56ed3ff9d637aa5070ce651f6bc7114134acff1ba692bee38a8b8545f4d20325e284f22284a845c30c6ecb4ac6ace5339

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr186041.exe

      Filesize

      12KB

      MD5

      9e74e103e534655b21355b299da19c75

      SHA1

      41f866ed16a04f8fdd40f7bf181186a37f00d4e4

      SHA256

      c9665c707e189d3905e494fa7800656a71addf9ca7fecba26c79d4875889258d

      SHA512

      88d4dcc96e7ad95593e16454dfcd1cbbdf84c05c96268fb68dd8461c982e8a0d05c811114a95559b45c330b98ea14240d61aff9526508e65c8c0b20e2a83945e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr186041.exe

      Filesize

      12KB

      MD5

      9e74e103e534655b21355b299da19c75

      SHA1

      41f866ed16a04f8fdd40f7bf181186a37f00d4e4

      SHA256

      c9665c707e189d3905e494fa7800656a71addf9ca7fecba26c79d4875889258d

      SHA512

      88d4dcc96e7ad95593e16454dfcd1cbbdf84c05c96268fb68dd8461c982e8a0d05c811114a95559b45c330b98ea14240d61aff9526508e65c8c0b20e2a83945e

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku233209.exe

      Filesize

      319KB

      MD5

      1d0fb81496e394c6702161d4b01d3e06

      SHA1

      9d67c2855bee10cca05d29625ecf1525b90a006c

      SHA256

      2be91c82a3a6c4daad6a81fb9ce38d618dae23f0550bfdc73e3ac74010e7ede2

      SHA512

      0cb62ecca438a1a5471ca4e96727eb1fa18d93df903f89c622aab17d82be1c7abbfb9f6fb071033adc248837e1626d8bbb1ddb93fbea4b7bbc10d94450d9ac07

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku233209.exe

      Filesize

      319KB

      MD5

      1d0fb81496e394c6702161d4b01d3e06

      SHA1

      9d67c2855bee10cca05d29625ecf1525b90a006c

      SHA256

      2be91c82a3a6c4daad6a81fb9ce38d618dae23f0550bfdc73e3ac74010e7ede2

      SHA512

      0cb62ecca438a1a5471ca4e96727eb1fa18d93df903f89c622aab17d82be1c7abbfb9f6fb071033adc248837e1626d8bbb1ddb93fbea4b7bbc10d94450d9ac07

    • memory/1856-197-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-207-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-157-0x0000000004D00000-0x00000000052A4000-memory.dmp

      Filesize

      5.6MB

    • memory/1856-158-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-159-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-161-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-163-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-165-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-167-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-169-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-171-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-173-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-175-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-177-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-179-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-181-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-183-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-185-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-187-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-189-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-186-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-191-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-193-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-195-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-155-0x0000000000620000-0x000000000066B000-memory.dmp

      Filesize

      300KB

    • memory/1856-199-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-201-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-203-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-205-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-156-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-209-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-211-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-213-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-215-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-217-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-219-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-221-0x0000000002640000-0x000000000267F000-memory.dmp

      Filesize

      252KB

    • memory/1856-1066-0x00000000052B0000-0x00000000058C8000-memory.dmp

      Filesize

      6.1MB

    • memory/1856-1067-0x0000000004B80000-0x0000000004C8A000-memory.dmp

      Filesize

      1.0MB

    • memory/1856-1068-0x0000000004CC0000-0x0000000004CD2000-memory.dmp

      Filesize

      72KB

    • memory/1856-1069-0x00000000058D0000-0x000000000590C000-memory.dmp

      Filesize

      240KB

    • memory/1856-1070-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-1072-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-1073-0x0000000005BB0000-0x0000000005C42000-memory.dmp

      Filesize

      584KB

    • memory/1856-1074-0x0000000005C50000-0x0000000005CB6000-memory.dmp

      Filesize

      408KB

    • memory/1856-1075-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-1076-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-1077-0x0000000006370000-0x0000000006532000-memory.dmp

      Filesize

      1.8MB

    • memory/1856-1078-0x0000000006550000-0x0000000006A7C000-memory.dmp

      Filesize

      5.2MB

    • memory/1856-1079-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/1856-1080-0x0000000006CD0000-0x0000000006D46000-memory.dmp

      Filesize

      472KB

    • memory/1856-1081-0x0000000006D50000-0x0000000006DA0000-memory.dmp

      Filesize

      320KB

    • memory/4228-147-0x0000000000E40000-0x0000000000E4A000-memory.dmp

      Filesize

      40KB

    • memory/4228-148-0x000000001CF90000-0x000000001D0DE000-memory.dmp

      Filesize

      1.3MB

    • memory/4228-150-0x000000001CF90000-0x000000001D0DE000-memory.dmp

      Filesize

      1.3MB

    • memory/4996-1087-0x0000000000E70000-0x0000000000EA2000-memory.dmp

      Filesize

      200KB

    • memory/4996-1088-0x00000000057B0000-0x00000000057C0000-memory.dmp

      Filesize

      64KB