Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    142s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/04/2023, 12:51

General

  • Target

    0e7e59d429f9c9a55dccaddc564930438192769cbba970b4b55294826cf76300.exe

  • Size

    658KB

  • MD5

    1e54db1d7053a2b068897bbf82827459

  • SHA1

    adc578c25607fc6114339e975665ed492781bf52

  • SHA256

    0e7e59d429f9c9a55dccaddc564930438192769cbba970b4b55294826cf76300

  • SHA512

    4f57b08469aa5fe2b06738ab6acc8f1212833a2a006020aff6724d1eded899f9a7a519e1b4d089b08cf36e586bc1ec396ae22598d81c78425839c3fcc45fe357

  • SSDEEP

    12288:MMrIy90qdadslLWpBk/EQ5eg9ohUOF3Bjpc01MRjg92HQKR1R:0yfcdqL4BqEeeJVBLKj62HBjR

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e7e59d429f9c9a55dccaddc564930438192769cbba970b4b55294826cf76300.exe
    "C:\Users\Admin\AppData\Local\Temp\0e7e59d429f9c9a55dccaddc564930438192769cbba970b4b55294826cf76300.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un807216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un807216.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1125.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1125.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4292
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0817.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0817.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2804
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962374.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962374.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3508

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962374.exe

    Filesize

    175KB

    MD5

    bb6d43fa4ebafe62b98ec4dea4ff49d9

    SHA1

    d8188e664ac977f59d3ec26589e3cf67b1fab23b

    SHA256

    1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

    SHA512

    679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si962374.exe

    Filesize

    175KB

    MD5

    bb6d43fa4ebafe62b98ec4dea4ff49d9

    SHA1

    d8188e664ac977f59d3ec26589e3cf67b1fab23b

    SHA256

    1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

    SHA512

    679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un807216.exe

    Filesize

    516KB

    MD5

    d8b17b46701b181f9aec1253bb0d7d6e

    SHA1

    31cd405872853d6ae1bcd957a56b192ef5d59f45

    SHA256

    2f4e811a93d11991fcba631ba2ead7c5fd325f6458d6d57b1eb0888c0b31cc39

    SHA512

    47bfc11e72c13f9a7552a04295472ea9fc44e721a44d2690d9f5f89a904e9bf1c81b2eaaf98befd5b42f704ea56306f9b1cc3b59043d2d10daa903f63f78f295

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un807216.exe

    Filesize

    516KB

    MD5

    d8b17b46701b181f9aec1253bb0d7d6e

    SHA1

    31cd405872853d6ae1bcd957a56b192ef5d59f45

    SHA256

    2f4e811a93d11991fcba631ba2ead7c5fd325f6458d6d57b1eb0888c0b31cc39

    SHA512

    47bfc11e72c13f9a7552a04295472ea9fc44e721a44d2690d9f5f89a904e9bf1c81b2eaaf98befd5b42f704ea56306f9b1cc3b59043d2d10daa903f63f78f295

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1125.exe

    Filesize

    236KB

    MD5

    360274b14ca08421bcdff4a4dfcfaea9

    SHA1

    251cc3b07c45b72b6718a6a1614a415872144324

    SHA256

    f59479d162fe11c4a9dbc055da1830a3ee71c971249a8f3fb2fb9d853196db32

    SHA512

    23916bdfd30a41de985dbfa1b6ab9ee0d0cbcea4f7de547e262737417f7d2a547094c1bf3a820bf5975c4cc6912fe81dc85acff824cbaf8841a7655ddbeafbc7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro1125.exe

    Filesize

    236KB

    MD5

    360274b14ca08421bcdff4a4dfcfaea9

    SHA1

    251cc3b07c45b72b6718a6a1614a415872144324

    SHA256

    f59479d162fe11c4a9dbc055da1830a3ee71c971249a8f3fb2fb9d853196db32

    SHA512

    23916bdfd30a41de985dbfa1b6ab9ee0d0cbcea4f7de547e262737417f7d2a547094c1bf3a820bf5975c4cc6912fe81dc85acff824cbaf8841a7655ddbeafbc7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0817.exe

    Filesize

    294KB

    MD5

    9b8d12a94ef8f8e07dcd993c64ecfced

    SHA1

    8dd7b184a1f462c7220121d59153151b28fbdf06

    SHA256

    92f1fbae678339c71382d336cff593b6ab90e0066327e80e11a1405b5cde97e7

    SHA512

    54cb389fa83c07495be26f6b1c58e2ab11760e455f112067362c1a2a1b3cedd45e6922331991d5cc6a75c83778985e7488b409cdc8a0876848f3e13ca608b383

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0817.exe

    Filesize

    294KB

    MD5

    9b8d12a94ef8f8e07dcd993c64ecfced

    SHA1

    8dd7b184a1f462c7220121d59153151b28fbdf06

    SHA256

    92f1fbae678339c71382d336cff593b6ab90e0066327e80e11a1405b5cde97e7

    SHA512

    54cb389fa83c07495be26f6b1c58e2ab11760e455f112067362c1a2a1b3cedd45e6922331991d5cc6a75c83778985e7488b409cdc8a0876848f3e13ca608b383

  • memory/2804-1090-0x0000000005850000-0x0000000005E56000-memory.dmp

    Filesize

    6.0MB

  • memory/2804-1091-0x0000000004B70000-0x0000000004C7A000-memory.dmp

    Filesize

    1.0MB

  • memory/2804-209-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-202-0x00000000004C0000-0x000000000050B000-memory.dmp

    Filesize

    300KB

  • memory/2804-205-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-1106-0x0000000006750000-0x0000000006C7C000-memory.dmp

    Filesize

    5.2MB

  • memory/2804-1105-0x0000000006580000-0x0000000006742000-memory.dmp

    Filesize

    1.8MB

  • memory/2804-1104-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-1103-0x00000000063B0000-0x0000000006400000-memory.dmp

    Filesize

    320KB

  • memory/2804-1102-0x0000000006330000-0x00000000063A6000-memory.dmp

    Filesize

    472KB

  • memory/2804-1101-0x0000000005530000-0x0000000005596000-memory.dmp

    Filesize

    408KB

  • memory/2804-1100-0x0000000005490000-0x0000000005522000-memory.dmp

    Filesize

    584KB

  • memory/2804-1099-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-1098-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-1097-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-1095-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-194-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-196-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-1094-0x0000000005340000-0x000000000538B000-memory.dmp

    Filesize

    300KB

  • memory/2804-1093-0x0000000004CA0000-0x0000000004CDE000-memory.dmp

    Filesize

    248KB

  • memory/2804-1092-0x0000000004C80000-0x0000000004C92000-memory.dmp

    Filesize

    72KB

  • memory/2804-211-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-217-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-179-0x0000000002420000-0x0000000002466000-memory.dmp

    Filesize

    280KB

  • memory/2804-180-0x00000000024E0000-0x0000000002524000-memory.dmp

    Filesize

    272KB

  • memory/2804-181-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-182-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-184-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-186-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-188-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-190-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-192-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-213-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-198-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-215-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-200-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-204-0x0000000004D30000-0x0000000004D40000-memory.dmp

    Filesize

    64KB

  • memory/2804-203-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/2804-207-0x00000000024E0000-0x000000000251F000-memory.dmp

    Filesize

    252KB

  • memory/3508-1113-0x0000000000B60000-0x0000000000B92000-memory.dmp

    Filesize

    200KB

  • memory/3508-1114-0x00000000055A0000-0x00000000055EB000-memory.dmp

    Filesize

    300KB

  • memory/3508-1115-0x0000000005750000-0x0000000005760000-memory.dmp

    Filesize

    64KB

  • memory/4292-169-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

    Filesize

    64KB

  • memory/4292-170-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

    Filesize

    64KB

  • memory/4292-141-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-139-0x0000000004AD0000-0x0000000004FCE000-memory.dmp

    Filesize

    5.0MB

  • memory/4292-138-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

    Filesize

    64KB

  • memory/4292-140-0x00000000022B0000-0x00000000022C8000-memory.dmp

    Filesize

    96KB

  • memory/4292-174-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/4292-172-0x0000000004AC0000-0x0000000004AD0000-memory.dmp

    Filesize

    64KB

  • memory/4292-171-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/4292-164-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-166-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-168-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-162-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-160-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-158-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-156-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-148-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-154-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-150-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-152-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-137-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/4292-136-0x0000000002220000-0x000000000223A000-memory.dmp

    Filesize

    104KB

  • memory/4292-146-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-144-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB

  • memory/4292-142-0x00000000022B0000-0x00000000022C2000-memory.dmp

    Filesize

    72KB