Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    59s
  • max time network
    130s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 08:52

General

  • Target

    cc4d93d2cf1d16109941077199bfedbbbbf37abcccc79660d6229907c2ab06ce.exe

  • Size

    658KB

  • MD5

    d1ec2ae3d8ec49ec4c18daf91b1d33de

  • SHA1

    59828e7e518fea0b07afbc906a73bb8f377105cc

  • SHA256

    cc4d93d2cf1d16109941077199bfedbbbbf37abcccc79660d6229907c2ab06ce

  • SHA512

    00851235473082ad1936d8ea81a00b9c9c39a2f8287b04e07c8851366da2ecc76a630ab6c98b981197b19f46180cf42043d3a8239489e4721942af668ff9f383

  • SSDEEP

    12288:9MrCy90aAT76SorYaljePHnlJNtnw322h4IQaU4cgG3:jyT/bj4H3NtS2rValG3

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc4d93d2cf1d16109941077199bfedbbbbf37abcccc79660d6229907c2ab06ce.exe
    "C:\Users\Admin\AppData\Local\Temp\cc4d93d2cf1d16109941077199bfedbbbbf37abcccc79660d6229907c2ab06ce.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127179.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127179.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3976
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0359.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0359.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3936
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3936 -s 1056
          4⤵
          • Program crash
          PID:2876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4031.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4031.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 1344
          4⤵
          • Program crash
          PID:1756
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976644.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976644.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4380
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3936 -ip 3936
    1⤵
      PID:4996
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 400 -ip 400
      1⤵
        PID:1628

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976644.exe

        Filesize

        176KB

        MD5

        0f5e15f1da41e9faf71e8f07e4efd42c

        SHA1

        e0c1f491e16637628665d9b61d8252ff908ba0cf

        SHA256

        2eb72d3ae75a3589cec37c3158a6d69ad6d678ea6cff85b18f455b9eabd1e684

        SHA512

        b3ef0607c33da73b778707ed495a69ffb85a62d124ae57f7f7558e3c0146ac15df583e551e7b2393fdf79046659db3e2578df56cb210ec77318204bccc9f93cc

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si976644.exe

        Filesize

        176KB

        MD5

        0f5e15f1da41e9faf71e8f07e4efd42c

        SHA1

        e0c1f491e16637628665d9b61d8252ff908ba0cf

        SHA256

        2eb72d3ae75a3589cec37c3158a6d69ad6d678ea6cff85b18f455b9eabd1e684

        SHA512

        b3ef0607c33da73b778707ed495a69ffb85a62d124ae57f7f7558e3c0146ac15df583e551e7b2393fdf79046659db3e2578df56cb210ec77318204bccc9f93cc

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127179.exe

        Filesize

        516KB

        MD5

        0753f783dde4af7ddd7ea77eac96caae

        SHA1

        f7b323267a842521914e21e29e94f23d2d171bef

        SHA256

        dd8d074a089b5999db7ad82384741b0e4ab330cdb0579f5bc5de5eed9ae6d288

        SHA512

        01ea2fc7da4aa37c949333c51f40febed8c9f035c87f7dc0bd2a8591bbcfd6a716d5d97a6ef2470518fc7e0fc028de676a4516c4ab24441f22dc19576ecbb241

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un127179.exe

        Filesize

        516KB

        MD5

        0753f783dde4af7ddd7ea77eac96caae

        SHA1

        f7b323267a842521914e21e29e94f23d2d171bef

        SHA256

        dd8d074a089b5999db7ad82384741b0e4ab330cdb0579f5bc5de5eed9ae6d288

        SHA512

        01ea2fc7da4aa37c949333c51f40febed8c9f035c87f7dc0bd2a8591bbcfd6a716d5d97a6ef2470518fc7e0fc028de676a4516c4ab24441f22dc19576ecbb241

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0359.exe

        Filesize

        284KB

        MD5

        469ab66a1f1647fb4a964ea87126336f

        SHA1

        9c49c45e5f9af5a4b2f32143ff960a3f256f5dd9

        SHA256

        b1ada215ba827e9c838a07ee2ad491f2405afdea30f4d03001ede42feff0111f

        SHA512

        5bac082e2fa80a8099824df77635cf7251c9d8731950ae34b3b4302f97121811f8178e1ff9511776f031dfeca0910c8e9be58870769acc084a4bdfd7cf028352

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0359.exe

        Filesize

        284KB

        MD5

        469ab66a1f1647fb4a964ea87126336f

        SHA1

        9c49c45e5f9af5a4b2f32143ff960a3f256f5dd9

        SHA256

        b1ada215ba827e9c838a07ee2ad491f2405afdea30f4d03001ede42feff0111f

        SHA512

        5bac082e2fa80a8099824df77635cf7251c9d8731950ae34b3b4302f97121811f8178e1ff9511776f031dfeca0910c8e9be58870769acc084a4bdfd7cf028352

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4031.exe

        Filesize

        342KB

        MD5

        73eb21c0db54186deb05d6b6f24a9cf7

        SHA1

        4e2c6c738e8d03b9cc73863e4266f4e722544a01

        SHA256

        dcb4a6b6ad242df41cb58752384eb85aa5b81239f734c56047736b3ff2f03824

        SHA512

        f4a9b3b9a38471bf29c952a7f179fff5bfc1c55df58588583be47b6653b48489efe095cb8dfe5742f79101fccb96c67ece63d11a428d902dfce19a39b4eebe48

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu4031.exe

        Filesize

        342KB

        MD5

        73eb21c0db54186deb05d6b6f24a9cf7

        SHA1

        4e2c6c738e8d03b9cc73863e4266f4e722544a01

        SHA256

        dcb4a6b6ad242df41cb58752384eb85aa5b81239f734c56047736b3ff2f03824

        SHA512

        f4a9b3b9a38471bf29c952a7f179fff5bfc1c55df58588583be47b6653b48489efe095cb8dfe5742f79101fccb96c67ece63d11a428d902dfce19a39b4eebe48

      • memory/400-1102-0x0000000007F00000-0x000000000800A000-memory.dmp

        Filesize

        1.0MB

      • memory/400-1105-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-1116-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-1115-0x0000000009410000-0x0000000009460000-memory.dmp

        Filesize

        320KB

      • memory/400-1114-0x0000000009370000-0x00000000093E6000-memory.dmp

        Filesize

        472KB

      • memory/400-1113-0x0000000008D20000-0x000000000924C000-memory.dmp

        Filesize

        5.2MB

      • memory/400-1112-0x0000000008B40000-0x0000000008D02000-memory.dmp

        Filesize

        1.8MB

      • memory/400-1111-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-1109-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-1110-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-1108-0x0000000008320000-0x0000000008386000-memory.dmp

        Filesize

        408KB

      • memory/400-1107-0x0000000008280000-0x0000000008312000-memory.dmp

        Filesize

        584KB

      • memory/400-211-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-1104-0x00000000072A0000-0x00000000072DC000-memory.dmp

        Filesize

        240KB

      • memory/400-1103-0x0000000007280000-0x0000000007292000-memory.dmp

        Filesize

        72KB

      • memory/400-1101-0x00000000078E0000-0x0000000007EF8000-memory.dmp

        Filesize

        6.1MB

      • memory/400-228-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-226-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-224-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-222-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-220-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-218-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-216-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-192-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-191-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-194-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-196-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-198-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-200-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-202-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-205-0x00000000047F0000-0x000000000483B000-memory.dmp

        Filesize

        300KB

      • memory/400-206-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-214-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-209-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-208-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/400-204-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/400-212-0x0000000004CE0000-0x0000000004D1F000-memory.dmp

        Filesize

        252KB

      • memory/3936-165-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-149-0x0000000007220000-0x00000000077C4000-memory.dmp

        Filesize

        5.6MB

      • memory/3936-153-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-186-0x0000000000400000-0x0000000002B75000-memory.dmp

        Filesize

        39.5MB

      • memory/3936-171-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-184-0x0000000007210000-0x0000000007220000-memory.dmp

        Filesize

        64KB

      • memory/3936-183-0x0000000007210000-0x0000000007220000-memory.dmp

        Filesize

        64KB

      • memory/3936-181-0x0000000000400000-0x0000000002B75000-memory.dmp

        Filesize

        39.5MB

      • memory/3936-180-0x0000000007210000-0x0000000007220000-memory.dmp

        Filesize

        64KB

      • memory/3936-150-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-179-0x0000000007210000-0x0000000007220000-memory.dmp

        Filesize

        64KB

      • memory/3936-178-0x0000000007210000-0x0000000007220000-memory.dmp

        Filesize

        64KB

      • memory/3936-151-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-177-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-185-0x0000000007210000-0x0000000007220000-memory.dmp

        Filesize

        64KB

      • memory/3936-175-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-169-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-167-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-173-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-163-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-161-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-159-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-157-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-155-0x0000000004B30000-0x0000000004B42000-memory.dmp

        Filesize

        72KB

      • memory/3936-148-0x0000000002C50000-0x0000000002C7D000-memory.dmp

        Filesize

        180KB

      • memory/4380-1123-0x00000000009A0000-0x00000000009D2000-memory.dmp

        Filesize

        200KB

      • memory/4380-1124-0x00000000052A0000-0x00000000052B0000-memory.dmp

        Filesize

        64KB

      • memory/4380-1125-0x00000000052A0000-0x00000000052B0000-memory.dmp

        Filesize

        64KB