Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    58s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/04/2023, 05:37

General

  • Target

    cb602bc2c5e083f8edac0a6e0d5d6420bdf231b702fdd036db8406424bef72ef.exe

  • Size

    659KB

  • MD5

    f6e228646713aef367970feb593df6e1

  • SHA1

    adc615539b1898c8f94bd44e850016946c60c0a8

  • SHA256

    cb602bc2c5e083f8edac0a6e0d5d6420bdf231b702fdd036db8406424bef72ef

  • SHA512

    c50e9f2cce12d3aae110f48bafd5f76ab50baf8859d2b624044b913624630686fd03b04171ca9e711e0f56d25d68bdc227cce8e80493221ee5c78b93c1c7c821

  • SSDEEP

    12288:UMr8y90cNIf+Fz0ErbJB8+TheB5EuHdUh7B0GpewsTe6Siv35jVqomVy:wypq+RG8o5p9wBcrSYpZmA

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb602bc2c5e083f8edac0a6e0d5d6420bdf231b702fdd036db8406424bef72ef.exe
    "C:\Users\Admin\AppData\Local\Temp\cb602bc2c5e083f8edac0a6e0d5d6420bdf231b702fdd036db8406424bef72ef.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un306820.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un306820.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2792
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5475.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5475.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4880
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4880 -s 1100
          4⤵
          • Program crash
          PID:3836
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8754.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8754.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1328
          4⤵
          • Program crash
          PID:4588
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487633.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487633.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1216
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4880 -ip 4880
    1⤵
      PID:4300
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4796 -ip 4796
      1⤵
        PID:2028

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487633.exe

        Filesize

        176KB

        MD5

        9d80a52f486eb620dd74426ac507c62e

        SHA1

        b5381841079b36a6e90bf5c7089cf8cfdc9d99c5

        SHA256

        7b1deb4fc6f3090ca0b0d8147611404d85177cf084e6feaa41dd77ef6955c5dc

        SHA512

        d16345ba50239f68b5f48ba9a1e15bcb0a2f9751eaccbed0e6e809708801cdd6f303326ef45707555ec438dc033a517cbc70674b09b488bde56a1911f6cbdfa9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si487633.exe

        Filesize

        176KB

        MD5

        9d80a52f486eb620dd74426ac507c62e

        SHA1

        b5381841079b36a6e90bf5c7089cf8cfdc9d99c5

        SHA256

        7b1deb4fc6f3090ca0b0d8147611404d85177cf084e6feaa41dd77ef6955c5dc

        SHA512

        d16345ba50239f68b5f48ba9a1e15bcb0a2f9751eaccbed0e6e809708801cdd6f303326ef45707555ec438dc033a517cbc70674b09b488bde56a1911f6cbdfa9

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un306820.exe

        Filesize

        518KB

        MD5

        af87ecdf12fbdabfa48cca829e66a606

        SHA1

        ecdd92309b9ffeea51170d96943fde222e76a8c6

        SHA256

        3f3f9266a458d7e7f14b4e00b8eedd0bd28550bc6657a61d0349bb4c7274aa8b

        SHA512

        edf768f5fa4c20d029dc6f47e9cd84031ad58188bf5bafc4e72e18618d162ac8e4e4753e01fb410ab070980faf429897980c9240413d3a4977c45364c0218d36

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un306820.exe

        Filesize

        518KB

        MD5

        af87ecdf12fbdabfa48cca829e66a606

        SHA1

        ecdd92309b9ffeea51170d96943fde222e76a8c6

        SHA256

        3f3f9266a458d7e7f14b4e00b8eedd0bd28550bc6657a61d0349bb4c7274aa8b

        SHA512

        edf768f5fa4c20d029dc6f47e9cd84031ad58188bf5bafc4e72e18618d162ac8e4e4753e01fb410ab070980faf429897980c9240413d3a4977c45364c0218d36

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5475.exe

        Filesize

        376KB

        MD5

        7db7b690f053a1696ef1c5b711e35a8e

        SHA1

        e2f68da3f84275633861780261462efda7cceda2

        SHA256

        a309b973eb4636fdb00db9d2b8f355b4551f7efad5affb0b76545c4e46bd7f7e

        SHA512

        c59a370b44020ed87e012edc9c9ae30fd2b68d73709fe71d70823bb6a325c06ccbb708a3ab5a12ec1d797a43683961d7e7463d7dd3c4c4d97d3736f5613ce81c

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro5475.exe

        Filesize

        376KB

        MD5

        7db7b690f053a1696ef1c5b711e35a8e

        SHA1

        e2f68da3f84275633861780261462efda7cceda2

        SHA256

        a309b973eb4636fdb00db9d2b8f355b4551f7efad5affb0b76545c4e46bd7f7e

        SHA512

        c59a370b44020ed87e012edc9c9ae30fd2b68d73709fe71d70823bb6a325c06ccbb708a3ab5a12ec1d797a43683961d7e7463d7dd3c4c4d97d3736f5613ce81c

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8754.exe

        Filesize

        434KB

        MD5

        1df5ced9072c1fb5a89407d3396f107c

        SHA1

        27a46ecd42f7f6c077aecc1f8fa033eb196cacf0

        SHA256

        51d0bf01b533ecbd7682cb82a28de2c656afaa362ce5dce4537001850f7cae1b

        SHA512

        c0823e3fb9a941db45f0a240aa370a09d7e1c6b97aa91b401d3df868abb4dceeefece3e62cc2a263dba7a5073465ad7e4e116d53d843526162f603f3ccc0ad6f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu8754.exe

        Filesize

        434KB

        MD5

        1df5ced9072c1fb5a89407d3396f107c

        SHA1

        27a46ecd42f7f6c077aecc1f8fa033eb196cacf0

        SHA256

        51d0bf01b533ecbd7682cb82a28de2c656afaa362ce5dce4537001850f7cae1b

        SHA512

        c0823e3fb9a941db45f0a240aa370a09d7e1c6b97aa91b401d3df868abb4dceeefece3e62cc2a263dba7a5073465ad7e4e116d53d843526162f603f3ccc0ad6f

      • memory/1216-1122-0x00000000054A0000-0x00000000054B0000-memory.dmp

        Filesize

        64KB

      • memory/1216-1121-0x0000000000BD0000-0x0000000000C02000-memory.dmp

        Filesize

        200KB

      • memory/4796-483-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-1104-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-1115-0x00000000084C0000-0x0000000008510000-memory.dmp

        Filesize

        320KB

      • memory/4796-1114-0x0000000008440000-0x00000000084B6000-memory.dmp

        Filesize

        472KB

      • memory/4796-1113-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-1112-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-1111-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-1110-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-1109-0x00000000069F0000-0x0000000006F1C000-memory.dmp

        Filesize

        5.2MB

      • memory/4796-1107-0x0000000006820000-0x00000000069E2000-memory.dmp

        Filesize

        1.8MB

      • memory/4796-1106-0x0000000006720000-0x00000000067B2000-memory.dmp

        Filesize

        584KB

      • memory/4796-1105-0x0000000006060000-0x00000000060C6000-memory.dmp

        Filesize

        408KB

      • memory/4796-1103-0x0000000005D70000-0x0000000005DAC000-memory.dmp

        Filesize

        240KB

      • memory/4796-1102-0x0000000005D50000-0x0000000005D62000-memory.dmp

        Filesize

        72KB

      • memory/4796-1101-0x0000000005C10000-0x0000000005D1A000-memory.dmp

        Filesize

        1.0MB

      • memory/4796-1100-0x0000000005570000-0x0000000005B88000-memory.dmp

        Filesize

        6.1MB

      • memory/4796-482-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-479-0x0000000004EA0000-0x0000000004EB0000-memory.dmp

        Filesize

        64KB

      • memory/4796-478-0x0000000002350000-0x000000000239B000-memory.dmp

        Filesize

        300KB

      • memory/4796-223-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-190-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-191-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-193-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-195-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-197-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-199-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-201-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-203-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-205-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-207-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-209-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-211-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-213-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-215-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-217-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-219-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4796-221-0x0000000004DF0000-0x0000000004E2F000-memory.dmp

        Filesize

        252KB

      • memory/4880-173-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-182-0x00000000028E0000-0x00000000028F0000-memory.dmp

        Filesize

        64KB

      • memory/4880-185-0x0000000000400000-0x0000000000813000-memory.dmp

        Filesize

        4.1MB

      • memory/4880-183-0x00000000028E0000-0x00000000028F0000-memory.dmp

        Filesize

        64KB

      • memory/4880-153-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-181-0x00000000028E0000-0x00000000028F0000-memory.dmp

        Filesize

        64KB

      • memory/4880-175-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-180-0x0000000000400000-0x0000000000813000-memory.dmp

        Filesize

        4.1MB

      • memory/4880-179-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-157-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-158-0x00000000028E0000-0x00000000028F0000-memory.dmp

        Filesize

        64KB

      • memory/4880-177-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-165-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-171-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-169-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-167-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-155-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-163-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-161-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-160-0x00000000028E0000-0x00000000028F0000-memory.dmp

        Filesize

        64KB

      • memory/4880-151-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-150-0x0000000002930000-0x0000000002942000-memory.dmp

        Filesize

        72KB

      • memory/4880-149-0x0000000004DB0000-0x0000000005354000-memory.dmp

        Filesize

        5.6MB

      • memory/4880-148-0x0000000000CB0000-0x0000000000CDD000-memory.dmp

        Filesize

        180KB