Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2023, 04:32

General

  • Target

    824b1a3562465f7e2c56019e7dae7482c5ec91f5885412d0a4cfbc6cbfc68fa2.exe

  • Size

    530KB

  • MD5

    47774209882a4d6e18b3647dc4c263ef

  • SHA1

    a2ce99f6201cec5d222a51d673a71dd886770fdf

  • SHA256

    824b1a3562465f7e2c56019e7dae7482c5ec91f5885412d0a4cfbc6cbfc68fa2

  • SHA512

    b7b62bdc4441653d4b2f004f4338b82a8941fd8609ae9e4f5bd9fc1bf66de15667f19e691ba058de9ec9dfb67eaeadfc2c6b1fd2ae3201d6640d30c8ca93b343

  • SSDEEP

    12288:zMrdy9025Ya76IGg3wJS+ZBNuXij2xgm3I1FcGpBeK:Cyl59fGiQnDj2xXI1qGGK

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\824b1a3562465f7e2c56019e7dae7482c5ec91f5885412d0a4cfbc6cbfc68fa2.exe
    "C:\Users\Admin\AppData\Local\Temp\824b1a3562465f7e2c56019e7dae7482c5ec91f5885412d0a4cfbc6cbfc68fa2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4936
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJe2273.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJe2273.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr780228.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr780228.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1008
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku735626.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku735626.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3560
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 1352
          4⤵
          • Program crash
          PID:2784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr745538.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr745538.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4504
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3560 -ip 3560
    1⤵
      PID:5048

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr745538.exe

      Filesize

      176KB

      MD5

      574501f5d42baaf6508ee3ac7681ee75

      SHA1

      61879a1bc2a7b6bdb2959ac6bd5c628e8e63b86c

      SHA256

      cd3cb25ae9c2cd3b4e43299948baaf98793fb0b3f2a6067c76801315d2b5c584

      SHA512

      d1debc7b7fd78b3f8ed6540855c56068da3e378323a6f60b6a2eb550166b7b1bff982293c4fb9453960a61e0ff8f61a3f7a95740fddcb16cf77c146bd92efaef

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr745538.exe

      Filesize

      176KB

      MD5

      574501f5d42baaf6508ee3ac7681ee75

      SHA1

      61879a1bc2a7b6bdb2959ac6bd5c628e8e63b86c

      SHA256

      cd3cb25ae9c2cd3b4e43299948baaf98793fb0b3f2a6067c76801315d2b5c584

      SHA512

      d1debc7b7fd78b3f8ed6540855c56068da3e378323a6f60b6a2eb550166b7b1bff982293c4fb9453960a61e0ff8f61a3f7a95740fddcb16cf77c146bd92efaef

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJe2273.exe

      Filesize

      389KB

      MD5

      c6f233abf2ea96d41abb6c10364ec34d

      SHA1

      2fe6852abfba23dd45461c513391ca6f5dd3ec0a

      SHA256

      138b67054a9acea573cf227414aecbfc686dd8c4eed5dcd3c171f5f8aed44306

      SHA512

      5edf9a3f43f27bdef2e835c9938a986d3a86ed5c056cd16b5dca50ddae9628b1c43facb67903db11562523de9e22c6f3e990dc38b427d761006ceff21f34f01c

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziJe2273.exe

      Filesize

      389KB

      MD5

      c6f233abf2ea96d41abb6c10364ec34d

      SHA1

      2fe6852abfba23dd45461c513391ca6f5dd3ec0a

      SHA256

      138b67054a9acea573cf227414aecbfc686dd8c4eed5dcd3c171f5f8aed44306

      SHA512

      5edf9a3f43f27bdef2e835c9938a986d3a86ed5c056cd16b5dca50ddae9628b1c43facb67903db11562523de9e22c6f3e990dc38b427d761006ceff21f34f01c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr780228.exe

      Filesize

      12KB

      MD5

      0ee9057f54482764d57de3704660c52f

      SHA1

      36fb1302d8d7f90cf4645737a3eb522b7f1c2412

      SHA256

      9f30ec1839b39b042cc00cd4f86173ab99e5d5df9a99d4d2bb32232caf749bc7

      SHA512

      9e8822e2f793e3a39d90138beae5d8f4a42f3155ce67e0e090e7845f16b651667158f13090cf5b9cfe6411396f0fbc68b23a1f9ebab3765f89da449ca25bc85b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr780228.exe

      Filesize

      12KB

      MD5

      0ee9057f54482764d57de3704660c52f

      SHA1

      36fb1302d8d7f90cf4645737a3eb522b7f1c2412

      SHA256

      9f30ec1839b39b042cc00cd4f86173ab99e5d5df9a99d4d2bb32232caf749bc7

      SHA512

      9e8822e2f793e3a39d90138beae5d8f4a42f3155ce67e0e090e7845f16b651667158f13090cf5b9cfe6411396f0fbc68b23a1f9ebab3765f89da449ca25bc85b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku735626.exe

      Filesize

      435KB

      MD5

      4d309571e3fb1307d574f2ca5d12827b

      SHA1

      89b3742e2c5e8e4133755d38b9342c904f8e8db3

      SHA256

      18ee55bc2fc206b372fe0cf692cb19b43c0d4fcccb969641f65505416ba3f31c

      SHA512

      be56976e58f6af0eaaf5d9ce4cfb6c7138b90957f1f816c4c578308ef09005e81fbb5f96ae548a3227837a8c8b002773e1263e8b32857dd284920e388fc2d631

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku735626.exe

      Filesize

      435KB

      MD5

      4d309571e3fb1307d574f2ca5d12827b

      SHA1

      89b3742e2c5e8e4133755d38b9342c904f8e8db3

      SHA256

      18ee55bc2fc206b372fe0cf692cb19b43c0d4fcccb969641f65505416ba3f31c

      SHA512

      be56976e58f6af0eaaf5d9ce4cfb6c7138b90957f1f816c4c578308ef09005e81fbb5f96ae548a3227837a8c8b002773e1263e8b32857dd284920e388fc2d631

    • memory/1008-147-0x0000000000690000-0x000000000069A000-memory.dmp

      Filesize

      40KB

    • memory/3560-153-0x0000000006BB0000-0x0000000007154000-memory.dmp

      Filesize

      5.6MB

    • memory/3560-154-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-155-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-156-0x0000000002530000-0x000000000257B000-memory.dmp

      Filesize

      300KB

    • memory/3560-160-0x0000000006BA0000-0x0000000006BB0000-memory.dmp

      Filesize

      64KB

    • memory/3560-159-0x0000000006BA0000-0x0000000006BB0000-memory.dmp

      Filesize

      64KB

    • memory/3560-158-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-162-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-166-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-164-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-168-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-170-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-172-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-174-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-176-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-178-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-180-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-182-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-184-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-186-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-188-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-190-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-192-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-194-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-196-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-198-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-200-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-202-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-204-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-206-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-208-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-210-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-212-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-214-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-218-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-216-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-220-0x0000000004470000-0x00000000044AF000-memory.dmp

      Filesize

      252KB

    • memory/3560-1063-0x0000000007160000-0x0000000007778000-memory.dmp

      Filesize

      6.1MB

    • memory/3560-1064-0x0000000007780000-0x000000000788A000-memory.dmp

      Filesize

      1.0MB

    • memory/3560-1065-0x0000000006B10000-0x0000000006B22000-memory.dmp

      Filesize

      72KB

    • memory/3560-1066-0x0000000006BA0000-0x0000000006BB0000-memory.dmp

      Filesize

      64KB

    • memory/3560-1067-0x0000000006B30000-0x0000000006B6C000-memory.dmp

      Filesize

      240KB

    • memory/3560-1069-0x0000000007B10000-0x0000000007BA2000-memory.dmp

      Filesize

      584KB

    • memory/3560-1070-0x0000000007BB0000-0x0000000007C16000-memory.dmp

      Filesize

      408KB

    • memory/3560-1071-0x00000000082C0000-0x0000000008336000-memory.dmp

      Filesize

      472KB

    • memory/3560-1072-0x0000000008340000-0x0000000008390000-memory.dmp

      Filesize

      320KB

    • memory/3560-1073-0x0000000006BA0000-0x0000000006BB0000-memory.dmp

      Filesize

      64KB

    • memory/3560-1074-0x0000000006BA0000-0x0000000006BB0000-memory.dmp

      Filesize

      64KB

    • memory/3560-1075-0x0000000006BA0000-0x0000000006BB0000-memory.dmp

      Filesize

      64KB

    • memory/3560-1076-0x00000000084F0000-0x00000000086B2000-memory.dmp

      Filesize

      1.8MB

    • memory/3560-1077-0x00000000086D0000-0x0000000008BFC000-memory.dmp

      Filesize

      5.2MB

    • memory/4504-1083-0x00000000001C0000-0x00000000001F2000-memory.dmp

      Filesize

      200KB

    • memory/4504-1084-0x0000000004E20000-0x0000000004E30000-memory.dmp

      Filesize

      64KB