Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2023, 09:09

General

  • Target

    0cb32d47a5753085fc4d60ab7da6bb8fe6618b55857df8e1eedd085e32d0ad5f.exe

  • Size

    522KB

  • MD5

    2b221f100f631216f04e482b340a271c

  • SHA1

    d95d61370889cad66bcd8c19ad40e29949c8d22f

  • SHA256

    0cb32d47a5753085fc4d60ab7da6bb8fe6618b55857df8e1eedd085e32d0ad5f

  • SHA512

    2dd4ec74d6fdf9f7fbd37cc27537baf5986bac126a91f3bfdb8771d1a94acc24806ec588bc65f617c24e54d91e93adc32d858ffa8f5a925c323f54a5973eeee1

  • SSDEEP

    12288:PMrdy90o5QcII15/T9EjrC6q6ImiqCgBH8sOOv3usJd:SyFdIoTyj26q6IDBgBH8vOvesJd

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 33 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0cb32d47a5753085fc4d60ab7da6bb8fe6618b55857df8e1eedd085e32d0ad5f.exe
    "C:\Users\Admin\AppData\Local\Temp\0cb32d47a5753085fc4d60ab7da6bb8fe6618b55857df8e1eedd085e32d0ad5f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVt8634.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVt8634.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr413920.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr413920.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1508
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku507976.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku507976.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4792
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 1560
          4⤵
          • Program crash
          PID:4852
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr460045.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr460045.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2912
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4792 -ip 4792
    1⤵
      PID:3904

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr460045.exe

      Filesize

      176KB

      MD5

      9033561734f17a8011816ad6b5756a5f

      SHA1

      2105b6f213f0196afb3514b76127337da9d454d9

      SHA256

      7bb20a2cabab0f82810e1b3f8cc839a148f8cda4335e7c1f866a8f31fd692555

      SHA512

      b21febfc15c64f140a802813210e4b3a08b1323a2df0f78c72f75c63549165bc91d418c57defa2fc45e319d9cdd62164704826b4b776943ba96c374ce5dd96eb

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr460045.exe

      Filesize

      176KB

      MD5

      9033561734f17a8011816ad6b5756a5f

      SHA1

      2105b6f213f0196afb3514b76127337da9d454d9

      SHA256

      7bb20a2cabab0f82810e1b3f8cc839a148f8cda4335e7c1f866a8f31fd692555

      SHA512

      b21febfc15c64f140a802813210e4b3a08b1323a2df0f78c72f75c63549165bc91d418c57defa2fc45e319d9cdd62164704826b4b776943ba96c374ce5dd96eb

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVt8634.exe

      Filesize

      379KB

      MD5

      e67c33ddc4816b08ddd2755a4e40321c

      SHA1

      4367eae23f8ab1ba999b29c0ad064dfc226833f6

      SHA256

      6e2d23856788cb79cde28cd20e8d81a7f7ccd9685c3204791ee61640b97ad0b4

      SHA512

      0fb2e1705b9fbbdf1038211cfe5f8bf87e063f764086bd6b79bfb5ac859a1a4bd23417771a9696d856eed198ff6bb448d8af37e6f119a936ed5ab133c8fd6729

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziVt8634.exe

      Filesize

      379KB

      MD5

      e67c33ddc4816b08ddd2755a4e40321c

      SHA1

      4367eae23f8ab1ba999b29c0ad064dfc226833f6

      SHA256

      6e2d23856788cb79cde28cd20e8d81a7f7ccd9685c3204791ee61640b97ad0b4

      SHA512

      0fb2e1705b9fbbdf1038211cfe5f8bf87e063f764086bd6b79bfb5ac859a1a4bd23417771a9696d856eed198ff6bb448d8af37e6f119a936ed5ab133c8fd6729

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr413920.exe

      Filesize

      14KB

      MD5

      f1d1827a4c79b1a42a8d3085d6a01527

      SHA1

      8ef108eddb49d4c01e2341125df41a4e54b7b573

      SHA256

      2dd571353e890b28cea40a71f85d7b5ccec364c126de2bed8ece6d66a76551b5

      SHA512

      bb1c4aac872c029a7105cc22849bc891edbf67754969a11cd84d1a0ca80bb863ff63df524b7cc25184ac1f14023731afbfd79d3219864a1ebe859af601fd38a3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr413920.exe

      Filesize

      14KB

      MD5

      f1d1827a4c79b1a42a8d3085d6a01527

      SHA1

      8ef108eddb49d4c01e2341125df41a4e54b7b573

      SHA256

      2dd571353e890b28cea40a71f85d7b5ccec364c126de2bed8ece6d66a76551b5

      SHA512

      bb1c4aac872c029a7105cc22849bc891edbf67754969a11cd84d1a0ca80bb863ff63df524b7cc25184ac1f14023731afbfd79d3219864a1ebe859af601fd38a3

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku507976.exe

      Filesize

      295KB

      MD5

      4c663a6f65a48188646c3e4aea5641b4

      SHA1

      7d3a9c512cf7d5c6fc32f5388a6d4a9e3df7ba78

      SHA256

      8cf72c8fcc62e62f927870c80816fb6851afa7cc61262ce21638277465ead258

      SHA512

      be68f916f5a00d932ff653947d7ceaf9b3351118cca764c470df8fd98ae100a0e1b52716532b57beb28aa973ab692e23dab2f82a99bfe1bb95b4e35d474f459b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku507976.exe

      Filesize

      295KB

      MD5

      4c663a6f65a48188646c3e4aea5641b4

      SHA1

      7d3a9c512cf7d5c6fc32f5388a6d4a9e3df7ba78

      SHA256

      8cf72c8fcc62e62f927870c80816fb6851afa7cc61262ce21638277465ead258

      SHA512

      be68f916f5a00d932ff653947d7ceaf9b3351118cca764c470df8fd98ae100a0e1b52716532b57beb28aa973ab692e23dab2f82a99bfe1bb95b4e35d474f459b

    • memory/1508-147-0x0000000000E50000-0x0000000000E5A000-memory.dmp

      Filesize

      40KB

    • memory/2912-1086-0x0000000000420000-0x0000000000452000-memory.dmp

      Filesize

      200KB

    • memory/2912-1088-0x0000000004E60000-0x0000000004E70000-memory.dmp

      Filesize

      64KB

    • memory/2912-1087-0x0000000004E60000-0x0000000004E70000-memory.dmp

      Filesize

      64KB

    • memory/4792-191-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-205-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-157-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-159-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-162-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-160-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-163-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-165-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-167-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-169-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-171-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-173-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-175-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-177-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-179-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-181-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-183-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-185-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-187-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-189-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-155-0x0000000004D40000-0x00000000052E4000-memory.dmp

      Filesize

      5.6MB

    • memory/4792-193-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-195-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-197-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-199-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-201-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-203-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-156-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-207-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-209-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-211-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-213-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-215-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-217-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-219-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-221-0x0000000002770000-0x00000000027AF000-memory.dmp

      Filesize

      252KB

    • memory/4792-1064-0x00000000052F0000-0x0000000005908000-memory.dmp

      Filesize

      6.1MB

    • memory/4792-1065-0x0000000005910000-0x0000000005A1A000-memory.dmp

      Filesize

      1.0MB

    • memory/4792-1066-0x0000000004CF0000-0x0000000004D02000-memory.dmp

      Filesize

      72KB

    • memory/4792-1067-0x0000000005A20000-0x0000000005A5C000-memory.dmp

      Filesize

      240KB

    • memory/4792-1068-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-1070-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-1071-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-1072-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-1073-0x0000000005CF0000-0x0000000005D56000-memory.dmp

      Filesize

      408KB

    • memory/4792-1074-0x00000000063B0000-0x0000000006442000-memory.dmp

      Filesize

      584KB

    • memory/4792-1075-0x0000000006490000-0x0000000006506000-memory.dmp

      Filesize

      472KB

    • memory/4792-1076-0x0000000006520000-0x0000000006570000-memory.dmp

      Filesize

      320KB

    • memory/4792-154-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/4792-153-0x00000000020D0000-0x000000000211B000-memory.dmp

      Filesize

      300KB

    • memory/4792-1077-0x0000000006590000-0x0000000006752000-memory.dmp

      Filesize

      1.8MB

    • memory/4792-1078-0x0000000006760000-0x0000000006C8C000-memory.dmp

      Filesize

      5.2MB

    • memory/4792-1079-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB