Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/04/2023, 13:39

General

  • Target

    4bf26ce561f73a6dbb4e2dac51eb47b43d564a1be31fd422147452730046dd3f.exe

  • Size

    659KB

  • MD5

    8096ff88aa06d2813ccd1a4746ad8bcc

  • SHA1

    c7757ea82150e25b4a341f1c877e7e53da540d28

  • SHA256

    4bf26ce561f73a6dbb4e2dac51eb47b43d564a1be31fd422147452730046dd3f

  • SHA512

    17b9fdb89405dd3692be3eff16fd13a41deb29046d49ceca9e7d1fecc955b2b5cfd6ee4263b4d319e7928c7490317e1f5d48bed0acc048e24b18dc9abe227046

  • SSDEEP

    12288:OMrUy90hzHj4zPC4xeBOBSMDWb4Q/LKoJYtY1gh0o0bCFEb/:myozD2PzooBSyQWC1gKE4

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 18 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bf26ce561f73a6dbb4e2dac51eb47b43d564a1be31fd422147452730046dd3f.exe
    "C:\Users\Admin\AppData\Local\Temp\4bf26ce561f73a6dbb4e2dac51eb47b43d564a1be31fd422147452730046dd3f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434046.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434046.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0066.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0066.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 5104 -s 1080
          4⤵
          • Program crash
          PID:4736
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8868.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8868.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3144
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 2036
          4⤵
          • Program crash
          PID:2788
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133238.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133238.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3184
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5104 -ip 5104
    1⤵
      PID:3084
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3144 -ip 3144
      1⤵
        PID:4536
      • C:\Windows\system32\sc.exe
        C:\Windows\system32\sc.exe start wuauserv
        1⤵
        • Launches sc.exe
        PID:2712

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133238.exe

        Filesize

        175KB

        MD5

        4b78aacd0680ccbbd11397bf13771462

        SHA1

        fa8e8bd75d2defb2807fe0fce6ff6b8dbe1e9447

        SHA256

        ebc1838741b358037e8f35ecd1a6b956e108d1baf92693b6e81e7cdfb09ce249

        SHA512

        edf36f161a42daefd0810569b384de80cf75c8166d0460427530669c856baac3ef862a326f2310073fe8c26fba61e5289ecc4b7ad407f5d59ba841586fba394d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si133238.exe

        Filesize

        175KB

        MD5

        4b78aacd0680ccbbd11397bf13771462

        SHA1

        fa8e8bd75d2defb2807fe0fce6ff6b8dbe1e9447

        SHA256

        ebc1838741b358037e8f35ecd1a6b956e108d1baf92693b6e81e7cdfb09ce249

        SHA512

        edf36f161a42daefd0810569b384de80cf75c8166d0460427530669c856baac3ef862a326f2310073fe8c26fba61e5289ecc4b7ad407f5d59ba841586fba394d

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434046.exe

        Filesize

        517KB

        MD5

        2271f382415e9d6e18359ce9da792923

        SHA1

        2646331ba16da23fefe230b16dd3b14ffa5b5e99

        SHA256

        7f99ffa0fa3e4a4371ee7a1e59fad663517dcfa16c0901f72c62341f7d601389

        SHA512

        eadefb44c5162ef1e4f76986d7c9a1cd9a6264b7b77257c99ea9751284ff47ea714862f62a615b0c2b58f2c54c3760f0a4e6e8d713ac0b1d7898d015bdcd04d1

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un434046.exe

        Filesize

        517KB

        MD5

        2271f382415e9d6e18359ce9da792923

        SHA1

        2646331ba16da23fefe230b16dd3b14ffa5b5e99

        SHA256

        7f99ffa0fa3e4a4371ee7a1e59fad663517dcfa16c0901f72c62341f7d601389

        SHA512

        eadefb44c5162ef1e4f76986d7c9a1cd9a6264b7b77257c99ea9751284ff47ea714862f62a615b0c2b58f2c54c3760f0a4e6e8d713ac0b1d7898d015bdcd04d1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0066.exe

        Filesize

        296KB

        MD5

        7f2b1a4309156096e16debc52b059592

        SHA1

        df3a32ef0e9c7a0ae593c1e4625397af79bd965d

        SHA256

        c36ee115946c41a26d778878a496d3872e9ba0805dd284b89d7853117c3202a4

        SHA512

        318a3c76c6e2382fc79682b254d737522d954b6de9e2ca159b53eb41121dc13ee61a8989829cf8120ce5db1a75d756235b482c79ea03570e21c3c09d0d4009b4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro0066.exe

        Filesize

        296KB

        MD5

        7f2b1a4309156096e16debc52b059592

        SHA1

        df3a32ef0e9c7a0ae593c1e4625397af79bd965d

        SHA256

        c36ee115946c41a26d778878a496d3872e9ba0805dd284b89d7853117c3202a4

        SHA512

        318a3c76c6e2382fc79682b254d737522d954b6de9e2ca159b53eb41121dc13ee61a8989829cf8120ce5db1a75d756235b482c79ea03570e21c3c09d0d4009b4

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8868.exe

        Filesize

        355KB

        MD5

        7a3d85fd0ae5779101a754a3b2133a0e

        SHA1

        31630de17c0249b04784bd2796ba82d3683aeeb4

        SHA256

        ded08a49d682ac318afc38ef6d8c7106909be30c5a70e27e123dff021f12f8c5

        SHA512

        52b23ea56a71fbf0f68d73267c3798952deaa4165a139d1b95c24eede07d19103885d43030015870a45c073d04ce8e79beab88c715c9ed9ea7d8307187aeeaa5

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8868.exe

        Filesize

        355KB

        MD5

        7a3d85fd0ae5779101a754a3b2133a0e

        SHA1

        31630de17c0249b04784bd2796ba82d3683aeeb4

        SHA256

        ded08a49d682ac318afc38ef6d8c7106909be30c5a70e27e123dff021f12f8c5

        SHA512

        52b23ea56a71fbf0f68d73267c3798952deaa4165a139d1b95c24eede07d19103885d43030015870a45c073d04ce8e79beab88c715c9ed9ea7d8307187aeeaa5

      • memory/3144-1102-0x0000000007F70000-0x000000000807A000-memory.dmp

        Filesize

        1.0MB

      • memory/3144-1103-0x00000000080B0000-0x00000000080C2000-memory.dmp

        Filesize

        72KB

      • memory/3144-1116-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1115-0x0000000009690000-0x00000000096E0000-memory.dmp

        Filesize

        320KB

      • memory/3144-1114-0x0000000009610000-0x0000000009686000-memory.dmp

        Filesize

        472KB

      • memory/3144-1113-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1112-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1111-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1110-0x0000000008D50000-0x000000000927C000-memory.dmp

        Filesize

        5.2MB

      • memory/3144-1109-0x0000000008B80000-0x0000000008D42000-memory.dmp

        Filesize

        1.8MB

      • memory/3144-1108-0x0000000008460000-0x00000000084C6000-memory.dmp

        Filesize

        408KB

      • memory/3144-1107-0x00000000083C0000-0x0000000008452000-memory.dmp

        Filesize

        584KB

      • memory/3144-1105-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-1104-0x00000000080D0000-0x000000000810C000-memory.dmp

        Filesize

        240KB

      • memory/3144-200-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-1101-0x00000000078D0000-0x0000000007EE8000-memory.dmp

        Filesize

        6.1MB

      • memory/3144-228-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-226-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-224-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-222-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-204-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-218-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-216-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-191-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-192-0x0000000002D10000-0x0000000002D5B000-memory.dmp

        Filesize

        300KB

      • memory/3144-194-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-196-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-198-0x0000000004890000-0x00000000048A0000-memory.dmp

        Filesize

        64KB

      • memory/3144-193-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-197-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-214-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-206-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-220-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-202-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-208-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-210-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3144-212-0x00000000076F0000-0x000000000772F000-memory.dmp

        Filesize

        252KB

      • memory/3184-1122-0x0000000000EF0000-0x0000000000F22000-memory.dmp

        Filesize

        200KB

      • memory/3184-1123-0x0000000005790000-0x00000000057A0000-memory.dmp

        Filesize

        64KB

      • memory/5104-156-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-149-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-184-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB

      • memory/5104-182-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB

      • memory/5104-183-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB

      • memory/5104-181-0x0000000000400000-0x0000000002B78000-memory.dmp

        Filesize

        39.5MB

      • memory/5104-180-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-150-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-178-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-152-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-176-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-186-0x0000000000400000-0x0000000002B78000-memory.dmp

        Filesize

        39.5MB

      • memory/5104-172-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-166-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-170-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-164-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-162-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-160-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-159-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB

      • memory/5104-157-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB

      • memory/5104-174-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-168-0x0000000004AE0000-0x0000000004AF2000-memory.dmp

        Filesize

        72KB

      • memory/5104-148-0x00000000073F0000-0x0000000007994000-memory.dmp

        Filesize

        5.6MB

      • memory/5104-155-0x00000000073E0000-0x00000000073F0000-memory.dmp

        Filesize

        64KB

      • memory/5104-153-0x0000000002D10000-0x0000000002D3D000-memory.dmp

        Filesize

        180KB