Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 13:25

General

  • Target

    3c36b78d455b0497815563a935003245db5ec818692219016c2a022b57bafb8e.exe

  • Size

    658KB

  • MD5

    b2d74d841f0944e17c1bf90413f0edd4

  • SHA1

    9a5b5cfcce946941e12762615fe44b28304dd056

  • SHA256

    3c36b78d455b0497815563a935003245db5ec818692219016c2a022b57bafb8e

  • SHA512

    efdeb2205b1ff91e5ed1a3dd8e25b3f05b93952f7e1b768f2f990aa89b0c75cd54db7dadf0d5a1e30fc356d460536434c1ce140bba82fa03a9fbd7c92cc395f6

  • SSDEEP

    12288:HMrey90Ym/errM58OssoyyRGkjI+AZvbpftXEOa0o0jMOys2:tyTfQ5wGS5eEOTVGs2

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 21 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c36b78d455b0497815563a935003245db5ec818692219016c2a022b57bafb8e.exe
    "C:\Users\Admin\AppData\Local\Temp\3c36b78d455b0497815563a935003245db5ec818692219016c2a022b57bafb8e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un330980.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un330980.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3266.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3266.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 1080
          4⤵
          • Program crash
          PID:4728
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0496.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0496.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1512
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 1316
          4⤵
          • Program crash
          PID:2072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328633.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328633.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3900 -ip 3900
    1⤵
      PID:3584
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1512 -ip 1512
      1⤵
        PID:4992

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328633.exe

        Filesize

        175KB

        MD5

        a588838757bbce50a8f8903711e28722

        SHA1

        2cc4e50d8b3bd1e574913bee000f6a2ffd42f4ab

        SHA256

        2c83c767277d05cbcbdb1114624d894375e2589a9b4d85774b5bbe533410a25c

        SHA512

        0cd1975a4a3efd1f4114ce2f2eade9478e6c6da8811eb09ea023957d7d9ddcd823aa111b3126a9f650c3548abdb9c8275e571ecc9bc4222b973e627815a20c5a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si328633.exe

        Filesize

        175KB

        MD5

        a588838757bbce50a8f8903711e28722

        SHA1

        2cc4e50d8b3bd1e574913bee000f6a2ffd42f4ab

        SHA256

        2c83c767277d05cbcbdb1114624d894375e2589a9b4d85774b5bbe533410a25c

        SHA512

        0cd1975a4a3efd1f4114ce2f2eade9478e6c6da8811eb09ea023957d7d9ddcd823aa111b3126a9f650c3548abdb9c8275e571ecc9bc4222b973e627815a20c5a

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un330980.exe

        Filesize

        516KB

        MD5

        3aaaf1c796957ec92bfc53867afc7a3b

        SHA1

        1a96d6d1ef7c75065b75afa2ccaf04da14dce571

        SHA256

        5d560929e20ca648b7b3a754feef9333623beba9097537d58b58c1674c1f17f5

        SHA512

        638f6c2ade5d8c5e6963337242265dd122e019359229af5a73aa7c21efb422122db218595062465bbf0ff082963075b0489f92b615b7ef79f84684c088ec9a27

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un330980.exe

        Filesize

        516KB

        MD5

        3aaaf1c796957ec92bfc53867afc7a3b

        SHA1

        1a96d6d1ef7c75065b75afa2ccaf04da14dce571

        SHA256

        5d560929e20ca648b7b3a754feef9333623beba9097537d58b58c1674c1f17f5

        SHA512

        638f6c2ade5d8c5e6963337242265dd122e019359229af5a73aa7c21efb422122db218595062465bbf0ff082963075b0489f92b615b7ef79f84684c088ec9a27

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3266.exe

        Filesize

        296KB

        MD5

        4488942828dbadd9af54d9a3dd82f2ff

        SHA1

        8cb5faef5eabae23df602dd365fdeaf2ddc11b10

        SHA256

        1354399d6b3d26f444d8a77ae2471841a1fd6c71ddb76343e0b969d2968bc0c6

        SHA512

        244e1bec35c67490599c0363ba559109c2aac79ddc6aea2c6ce32d6ab91cf1d46b70403e350749c77a74d9fe196fd04dba9d1c63c7c826a85b8b666336910acc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro3266.exe

        Filesize

        296KB

        MD5

        4488942828dbadd9af54d9a3dd82f2ff

        SHA1

        8cb5faef5eabae23df602dd365fdeaf2ddc11b10

        SHA256

        1354399d6b3d26f444d8a77ae2471841a1fd6c71ddb76343e0b969d2968bc0c6

        SHA512

        244e1bec35c67490599c0363ba559109c2aac79ddc6aea2c6ce32d6ab91cf1d46b70403e350749c77a74d9fe196fd04dba9d1c63c7c826a85b8b666336910acc

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0496.exe

        Filesize

        355KB

        MD5

        b8c8c2226ac328f2d0e883abfd185214

        SHA1

        7c52bee9e336ba3f6107620d7e50188a7749456f

        SHA256

        a59973716fec36669a5e1926a0aa23e34eb117cf7724caf6d49f9ae617cae8eb

        SHA512

        85ce4596d229c1321392a3881c7e21f7dfb1991e6c2b7b8ebe4bd7e20cb2bfe5f4dd1d1f1463ad1f660ca881d8ede181eb3eff7cfd61b8c07d6eb86ac548ace4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0496.exe

        Filesize

        355KB

        MD5

        b8c8c2226ac328f2d0e883abfd185214

        SHA1

        7c52bee9e336ba3f6107620d7e50188a7749456f

        SHA256

        a59973716fec36669a5e1926a0aa23e34eb117cf7724caf6d49f9ae617cae8eb

        SHA512

        85ce4596d229c1321392a3881c7e21f7dfb1991e6c2b7b8ebe4bd7e20cb2bfe5f4dd1d1f1463ad1f660ca881d8ede181eb3eff7cfd61b8c07d6eb86ac548ace4

      • memory/1512-1102-0x0000000007E30000-0x0000000007F3A000-memory.dmp

        Filesize

        1.0MB

      • memory/1512-1103-0x0000000007F70000-0x0000000007F82000-memory.dmp

        Filesize

        72KB

      • memory/1512-1116-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-1115-0x0000000008F80000-0x00000000094AC000-memory.dmp

        Filesize

        5.2MB

      • memory/1512-1114-0x0000000008D70000-0x0000000008F32000-memory.dmp

        Filesize

        1.8MB

      • memory/1512-1113-0x0000000008BB0000-0x0000000008C00000-memory.dmp

        Filesize

        320KB

      • memory/1512-1112-0x0000000008B20000-0x0000000008B96000-memory.dmp

        Filesize

        472KB

      • memory/1512-1111-0x0000000008950000-0x00000000089E2000-memory.dmp

        Filesize

        584KB

      • memory/1512-1110-0x0000000008280000-0x00000000082E6000-memory.dmp

        Filesize

        408KB

      • memory/1512-1109-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-1108-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-1107-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-1105-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-1104-0x0000000007FD0000-0x000000000800C000-memory.dmp

        Filesize

        240KB

      • memory/1512-206-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-1101-0x0000000007790000-0x0000000007DA8000-memory.dmp

        Filesize

        6.1MB

      • memory/1512-307-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-305-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-303-0x00000000071C0000-0x00000000071D0000-memory.dmp

        Filesize

        64KB

      • memory/1512-301-0x00000000047D0000-0x000000000481B000-memory.dmp

        Filesize

        300KB

      • memory/1512-208-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-224-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-220-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-191-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-192-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-194-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-198-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-196-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-200-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-202-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-218-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-210-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-222-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-204-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-214-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-212-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/1512-216-0x0000000007130000-0x000000000716F000-memory.dmp

        Filesize

        252KB

      • memory/2836-1122-0x00000000003B0000-0x00000000003E2000-memory.dmp

        Filesize

        200KB

      • memory/2836-1123-0x0000000004F30000-0x0000000004F40000-memory.dmp

        Filesize

        64KB

      • memory/3900-154-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-149-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/3900-184-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/3900-183-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/3900-182-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/3900-181-0x0000000000400000-0x0000000002B78000-memory.dmp

        Filesize

        39.5MB

      • memory/3900-160-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-150-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB

      • memory/3900-170-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-153-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-174-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-186-0x0000000000400000-0x0000000002B78000-memory.dmp

        Filesize

        39.5MB

      • memory/3900-180-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-162-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-176-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-168-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-164-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-166-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-156-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-158-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-178-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-172-0x0000000004AD0000-0x0000000004AE2000-memory.dmp

        Filesize

        72KB

      • memory/3900-148-0x0000000002CD0000-0x0000000002CFD000-memory.dmp

        Filesize

        180KB

      • memory/3900-152-0x0000000007330000-0x00000000078D4000-memory.dmp

        Filesize

        5.6MB

      • memory/3900-151-0x0000000007320000-0x0000000007330000-memory.dmp

        Filesize

        64KB