Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 11:19

General

  • Target

    8426ed557b582e696f69b5fc98b375ca33b8e6033162baaa820fab22ba0e41b1.exe

  • Size

    530KB

  • MD5

    86c3a9b7c1158a77e50d28c917a476b4

  • SHA1

    6ef7f05c051e1b9fba25309e09d733b07a69403b

  • SHA256

    8426ed557b582e696f69b5fc98b375ca33b8e6033162baaa820fab22ba0e41b1

  • SHA512

    3e2fd1588d9cd269849c15299fbb9f261f5fb210717850408fc5a904db2483148732cb2021863b95c543730bf7f09a88509c7349e440be189c5c17de8875c1c3

  • SSDEEP

    12288:uMrhy90o3dGh63gYi0peunIqVveuT4IlLVJQGAlKMjk:LyzdQ6QYJejqlYYLEMMk

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8426ed557b582e696f69b5fc98b375ca33b8e6033162baaa820fab22ba0e41b1.exe
    "C:\Users\Admin\AppData\Local\Temp\8426ed557b582e696f69b5fc98b375ca33b8e6033162baaa820fab22ba0e41b1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2884
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNB4096.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNB4096.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr779457.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr779457.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku863852.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku863852.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3240
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3240 -s 1488
          4⤵
          • Program crash
          PID:4976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr325744.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr325744.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5020
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3240 -ip 3240
    1⤵
      PID:5112

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr325744.exe

      Filesize

      176KB

      MD5

      72229c24c4118bf3c5e30acbd08e165a

      SHA1

      aa347e4493e2a6c7d1e48e73182eca5e47d22fac

      SHA256

      f8d20bbac51439befcf6d0850ad1d27bc14cda5180d69b42ca93421d845bbbe4

      SHA512

      c25a2541e4cc52f236d1956febf99f8f4d349a3fcc2968a01dfa53d0d641aff4aa56f9ae45f3a08be36a6169b6e7ca6636b8a9bc5028a1c7d2cccd168fb73649

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr325744.exe

      Filesize

      176KB

      MD5

      72229c24c4118bf3c5e30acbd08e165a

      SHA1

      aa347e4493e2a6c7d1e48e73182eca5e47d22fac

      SHA256

      f8d20bbac51439befcf6d0850ad1d27bc14cda5180d69b42ca93421d845bbbe4

      SHA512

      c25a2541e4cc52f236d1956febf99f8f4d349a3fcc2968a01dfa53d0d641aff4aa56f9ae45f3a08be36a6169b6e7ca6636b8a9bc5028a1c7d2cccd168fb73649

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNB4096.exe

      Filesize

      387KB

      MD5

      045a11f234ded9b734d604aafcbcdf7a

      SHA1

      35a8bb8b6df2236043cdfd987b57a34f574380d6

      SHA256

      8b04673063d0996e21f46ebf4a2fedf7a8890b0f41a4258aa62f5a9aecf1d4ea

      SHA512

      29f4e7c5915cefab680d7cb5bc278f00da66b4cc974aa766c464d19fcb5e955cf463fb0220288691df9a832d71cf0c6f7c862ee0b21e1f21acacbe7dbbbdfdce

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziNB4096.exe

      Filesize

      387KB

      MD5

      045a11f234ded9b734d604aafcbcdf7a

      SHA1

      35a8bb8b6df2236043cdfd987b57a34f574380d6

      SHA256

      8b04673063d0996e21f46ebf4a2fedf7a8890b0f41a4258aa62f5a9aecf1d4ea

      SHA512

      29f4e7c5915cefab680d7cb5bc278f00da66b4cc974aa766c464d19fcb5e955cf463fb0220288691df9a832d71cf0c6f7c862ee0b21e1f21acacbe7dbbbdfdce

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr779457.exe

      Filesize

      12KB

      MD5

      296f85ad313fc204c888a274bc44d2a2

      SHA1

      65e23ebad3bb0f613db5a5a3d85d183b80ff6880

      SHA256

      70b2af74b3af8847ce7ada713b73dc6766be159d52759c35d4ae0489e83bbca4

      SHA512

      0b507ec0a969f421c9b48cd4683c43c76b674a9ea66bcffaa0830fae936c9ecffdcab52cb69ab9737489e5dc6f8ab621b6ac1cca5d51dc1496cdb43c9ee10e4b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr779457.exe

      Filesize

      12KB

      MD5

      296f85ad313fc204c888a274bc44d2a2

      SHA1

      65e23ebad3bb0f613db5a5a3d85d183b80ff6880

      SHA256

      70b2af74b3af8847ce7ada713b73dc6766be159d52759c35d4ae0489e83bbca4

      SHA512

      0b507ec0a969f421c9b48cd4683c43c76b674a9ea66bcffaa0830fae936c9ecffdcab52cb69ab9737489e5dc6f8ab621b6ac1cca5d51dc1496cdb43c9ee10e4b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku863852.exe

      Filesize

      342KB

      MD5

      c6d40473e84ce1da0fb47a84dd65fed0

      SHA1

      076675e3372731a3f1eddde59f8ada4f833f1d67

      SHA256

      6bc4af1ebd89932c2e0fedf83931038958547bf6f56c12f9c1033c42273afa47

      SHA512

      9e3ed94ba2d10d5229c1b51485d82ea9add1d995a76a17c354b2b8dccc6249b5823c34cef55ef1e50f306457563ff5cb98bde01cb98e6d12254b70c0c445c600

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku863852.exe

      Filesize

      342KB

      MD5

      c6d40473e84ce1da0fb47a84dd65fed0

      SHA1

      076675e3372731a3f1eddde59f8ada4f833f1d67

      SHA256

      6bc4af1ebd89932c2e0fedf83931038958547bf6f56c12f9c1033c42273afa47

      SHA512

      9e3ed94ba2d10d5229c1b51485d82ea9add1d995a76a17c354b2b8dccc6249b5823c34cef55ef1e50f306457563ff5cb98bde01cb98e6d12254b70c0c445c600

    • memory/2016-147-0x0000000000780000-0x000000000078A000-memory.dmp

      Filesize

      40KB

    • memory/3240-153-0x0000000007180000-0x0000000007724000-memory.dmp

      Filesize

      5.6MB

    • memory/3240-154-0x0000000002EF0000-0x0000000002F3B000-memory.dmp

      Filesize

      300KB

    • memory/3240-155-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-157-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-156-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-158-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-161-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-163-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-159-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-165-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-167-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-169-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-171-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-173-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-175-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-177-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-179-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-181-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-183-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-185-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-187-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-189-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-191-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-193-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-195-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-197-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-199-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-201-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-203-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-205-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-207-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-209-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-211-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-213-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-215-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-217-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-219-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-221-0x0000000007730000-0x000000000776F000-memory.dmp

      Filesize

      252KB

    • memory/3240-1065-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-1066-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-1067-0x0000000007790000-0x0000000007DA8000-memory.dmp

      Filesize

      6.1MB

    • memory/3240-1068-0x0000000007E30000-0x0000000007F3A000-memory.dmp

      Filesize

      1.0MB

    • memory/3240-1069-0x0000000007F70000-0x0000000007F82000-memory.dmp

      Filesize

      72KB

    • memory/3240-1070-0x0000000007F90000-0x0000000007FCC000-memory.dmp

      Filesize

      240KB

    • memory/3240-1071-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-1073-0x0000000007170000-0x0000000007180000-memory.dmp

      Filesize

      64KB

    • memory/3240-1075-0x0000000008500000-0x0000000008592000-memory.dmp

      Filesize

      584KB

    • memory/3240-1077-0x00000000085A0000-0x0000000008606000-memory.dmp

      Filesize

      408KB

    • memory/3240-1078-0x0000000008A20000-0x0000000008A96000-memory.dmp

      Filesize

      472KB

    • memory/3240-1079-0x0000000008AB0000-0x0000000008B00000-memory.dmp

      Filesize

      320KB

    • memory/3240-1081-0x0000000008DA0000-0x0000000008F62000-memory.dmp

      Filesize

      1.8MB

    • memory/3240-1082-0x0000000008F70000-0x000000000949C000-memory.dmp

      Filesize

      5.2MB

    • memory/5020-1089-0x0000000000C80000-0x0000000000CB2000-memory.dmp

      Filesize

      200KB

    • memory/5020-1090-0x00000000058B0000-0x00000000058C0000-memory.dmp

      Filesize

      64KB

    • memory/5020-1091-0x00000000058B0000-0x00000000058C0000-memory.dmp

      Filesize

      64KB