Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2023, 16:40

General

  • Target

    4bbcc65e69b88c64231eb1f54301d1f78d4a26ce9154631515d628a5610961fc.exe

  • Size

    660KB

  • MD5

    50215917ada7cf6189594770feddb403

  • SHA1

    9921b892113895ce505dc3bb5849acb79f7325ee

  • SHA256

    4bbcc65e69b88c64231eb1f54301d1f78d4a26ce9154631515d628a5610961fc

  • SHA512

    5dfdb284f12e43e9ba54cad9d3f4cf5c19c5fa75fbc158898c793278bb4c5d2b9e861195e11141009a7d2cff464f096e6002b76183861f788e0777d6beb0ace4

  • SSDEEP

    12288:+Mryy90S+Lwi32FjshDqv6U31wi0yswrLiCiGaWPSETQHv:gyp+Lf2FjshISizsw6CiG55+

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

C2

176.113.115.145:4125

Attributes
  • auth_value

    441b39ab37774b2ca9931c31e1bc6071

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bbcc65e69b88c64231eb1f54301d1f78d4a26ce9154631515d628a5610961fc.exe
    "C:\Users\Admin\AppData\Local\Temp\4bbcc65e69b88c64231eb1f54301d1f78d4a26ce9154631515d628a5610961fc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621258.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621258.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1284
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6251.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6251.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 1080
          4⤵
          • Program crash
          PID:2132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0788.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0788.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:744
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 744 -s 1368
          4⤵
          • Program crash
          PID:1248
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si448774.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si448774.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2340
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3752 -ip 3752
    1⤵
      PID:948
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 744 -ip 744
      1⤵
        PID:516

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si448774.exe

        Filesize

        175KB

        MD5

        bb6d43fa4ebafe62b98ec4dea4ff49d9

        SHA1

        d8188e664ac977f59d3ec26589e3cf67b1fab23b

        SHA256

        1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

        SHA512

        679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si448774.exe

        Filesize

        175KB

        MD5

        bb6d43fa4ebafe62b98ec4dea4ff49d9

        SHA1

        d8188e664ac977f59d3ec26589e3cf67b1fab23b

        SHA256

        1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

        SHA512

        679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621258.exe

        Filesize

        518KB

        MD5

        e91b03ca94141af0a5b5daaa20480687

        SHA1

        67979b315ece26ba4b06e9313a188da3dce01919

        SHA256

        05b04be8b8d40b080df3d57b2b576455aacd04d1fbad9ad8ef5f0082f701f51b

        SHA512

        e039b99f9939a54ca333d3cf72f918bc07990e2e22366225f7ec6f8fde589a84fccceda56c291046c81b414bcf4056a007eff0c6660c6a4d6e2851726266549f

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un621258.exe

        Filesize

        518KB

        MD5

        e91b03ca94141af0a5b5daaa20480687

        SHA1

        67979b315ece26ba4b06e9313a188da3dce01919

        SHA256

        05b04be8b8d40b080df3d57b2b576455aacd04d1fbad9ad8ef5f0082f701f51b

        SHA512

        e039b99f9939a54ca333d3cf72f918bc07990e2e22366225f7ec6f8fde589a84fccceda56c291046c81b414bcf4056a007eff0c6660c6a4d6e2851726266549f

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6251.exe

        Filesize

        236KB

        MD5

        13696a09359bd25a476cafaafd37e289

        SHA1

        a8a62d8501722665b888526238ad811498a07f1d

        SHA256

        6c5e252d95d871070c4a359d69880b5a5a555238d8e9b56b5be931e4b199d59c

        SHA512

        7ffcdf5e8aad4c6d857ba73c5ec50d785098da14401c5f7a681f1f601b2dae112113d3b248780e3e8c34343cdb33a01187c70616c5cf7af2404a58a3e021b8a1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\pro6251.exe

        Filesize

        236KB

        MD5

        13696a09359bd25a476cafaafd37e289

        SHA1

        a8a62d8501722665b888526238ad811498a07f1d

        SHA256

        6c5e252d95d871070c4a359d69880b5a5a555238d8e9b56b5be931e4b199d59c

        SHA512

        7ffcdf5e8aad4c6d857ba73c5ec50d785098da14401c5f7a681f1f601b2dae112113d3b248780e3e8c34343cdb33a01187c70616c5cf7af2404a58a3e021b8a1

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0788.exe

        Filesize

        295KB

        MD5

        dc3c0b135a60c113fe29757b2a9bcd9c

        SHA1

        2fc0b2473b8c355b1a22e39b6592723ba6123109

        SHA256

        2b135a8d1429c3be8afedc59fedff28c72e6a6fb944e20fc6dd92a2678c3e2e8

        SHA512

        2b206ae3118d9a5a5d4e01cf5563c98a3636e5f8fda7b5130345cce203cbe3592c84b95bdab5f20d2bb3c9bfdf018f3e137ca673311210149f6da05f314d4337

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qu0788.exe

        Filesize

        295KB

        MD5

        dc3c0b135a60c113fe29757b2a9bcd9c

        SHA1

        2fc0b2473b8c355b1a22e39b6592723ba6123109

        SHA256

        2b135a8d1429c3be8afedc59fedff28c72e6a6fb944e20fc6dd92a2678c3e2e8

        SHA512

        2b206ae3118d9a5a5d4e01cf5563c98a3636e5f8fda7b5130345cce203cbe3592c84b95bdab5f20d2bb3c9bfdf018f3e137ca673311210149f6da05f314d4337

      • memory/744-1099-0x00000000052F0000-0x0000000005908000-memory.dmp

        Filesize

        6.1MB

      • memory/744-1102-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-1114-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-1113-0x00000000079E0000-0x0000000007F0C000-memory.dmp

        Filesize

        5.2MB

      • memory/744-1112-0x0000000007800000-0x00000000079C2000-memory.dmp

        Filesize

        1.8MB

      • memory/744-1111-0x00000000064E0000-0x0000000006530000-memory.dmp

        Filesize

        320KB

      • memory/744-1110-0x0000000006450000-0x00000000064C6000-memory.dmp

        Filesize

        472KB

      • memory/744-1109-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-1108-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-1107-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-1106-0x0000000005C50000-0x0000000005CB6000-memory.dmp

        Filesize

        408KB

      • memory/744-1105-0x0000000005BB0000-0x0000000005C42000-memory.dmp

        Filesize

        584KB

      • memory/744-1103-0x0000000004CF0000-0x0000000004D2C000-memory.dmp

        Filesize

        240KB

      • memory/744-1101-0x0000000002650000-0x0000000002662000-memory.dmp

        Filesize

        72KB

      • memory/744-1100-0x0000000004BE0000-0x0000000004CEA000-memory.dmp

        Filesize

        1.0MB

      • memory/744-226-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-224-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-222-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-220-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-218-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-216-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-190-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-192-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-189-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-194-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-196-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-198-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-200-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-202-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-204-0x0000000000610000-0x000000000065B000-memory.dmp

        Filesize

        300KB

      • memory/744-206-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-209-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-210-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-208-0x0000000004D30000-0x0000000004D40000-memory.dmp

        Filesize

        64KB

      • memory/744-205-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-212-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/744-214-0x0000000002540000-0x000000000257F000-memory.dmp

        Filesize

        252KB

      • memory/2340-1120-0x0000000000740000-0x0000000000772000-memory.dmp

        Filesize

        200KB

      • memory/2340-1122-0x0000000005310000-0x0000000005320000-memory.dmp

        Filesize

        64KB

      • memory/2340-1121-0x0000000005310000-0x0000000005320000-memory.dmp

        Filesize

        64KB

      • memory/3752-172-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-168-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-180-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/3752-150-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/3752-179-0x0000000000400000-0x00000000004AA000-memory.dmp

        Filesize

        680KB

      • memory/3752-178-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-154-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-176-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-174-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-151-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-170-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-181-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/3752-166-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-164-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-162-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-160-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-158-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-156-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB

      • memory/3752-149-0x00000000020C0000-0x00000000020ED000-memory.dmp

        Filesize

        180KB

      • memory/3752-148-0x0000000004AF0000-0x0000000005094000-memory.dmp

        Filesize

        5.6MB

      • memory/3752-182-0x0000000002270000-0x0000000002280000-memory.dmp

        Filesize

        64KB

      • memory/3752-184-0x0000000000400000-0x00000000004AA000-memory.dmp

        Filesize

        680KB

      • memory/3752-152-0x00000000024C0000-0x00000000024D2000-memory.dmp

        Filesize

        72KB