Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/04/2023, 00:21

General

  • Target

    1b4fa3c9d1a0fc2523e252994157501cb36c6418b5023ec73cea5462deaa6e4a.exe

  • Size

    924KB

  • MD5

    b05d76bd5741761e8f77eb6dea4e30f5

  • SHA1

    7786e298b16004c1c8d08bab405a64bc88bea0bb

  • SHA256

    1b4fa3c9d1a0fc2523e252994157501cb36c6418b5023ec73cea5462deaa6e4a

  • SHA512

    50eb19baad322e7e25167a15417a2ac4d00496c70f13c538cb5ec83fabe39be884391b7add0ef7c7fd82c7cc76e092dbdd0dfdf6d786c2a6a753661b08f479b4

  • SSDEEP

    24576:5yoHQ854Ms7vD/EzNeSJg9re196/QZ650q8:soHQ8y7DqeSJg9r22t0

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nahui

C2

176.113.115.145:4125

Attributes
  • auth_value

    b9ed10946d21e28d58d0c72c535cde6f

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b4fa3c9d1a0fc2523e252994157501cb36c6418b5023ec73cea5462deaa6e4a.exe
    "C:\Users\Admin\AppData\Local\Temp\1b4fa3c9d1a0fc2523e252994157501cb36c6418b5023ec73cea5462deaa6e4a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un124478.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un124478.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2324
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un707191.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un707191.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr239432.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr239432.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2900
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu160502.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu160502.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2552
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081201.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081201.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3672
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si095037.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si095037.exe
      2⤵
      • Executes dropped EXE
      PID:1692
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 624
        3⤵
        • Program crash
        PID:1804
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 708
        3⤵
        • Program crash
        PID:4724
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 776
        3⤵
        • Program crash
        PID:752
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 844
        3⤵
        • Program crash
        PID:4856
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 876
        3⤵
        • Program crash
        PID:4084
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 852
        3⤵
        • Program crash
        PID:3344
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 1080
        3⤵
        • Program crash
        PID:4352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si095037.exe

    Filesize

    230KB

    MD5

    4be9d89cb3308ce100c56b5bdbccafac

    SHA1

    274f57114096a555ece5bcd983fd670f4f971ece

    SHA256

    9f5400b19dabef76d3c52058cb5709d323dfd42387cc2202cde0e92016e3bdc9

    SHA512

    1095ae9191de62663ce440bc9adfab1ea609c1458d547e43ec309561fde518f45f0820bb699f0c9a771cc9c3a2703b86086a3767c5e2d10bf829f2a668f8175f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si095037.exe

    Filesize

    230KB

    MD5

    4be9d89cb3308ce100c56b5bdbccafac

    SHA1

    274f57114096a555ece5bcd983fd670f4f971ece

    SHA256

    9f5400b19dabef76d3c52058cb5709d323dfd42387cc2202cde0e92016e3bdc9

    SHA512

    1095ae9191de62663ce440bc9adfab1ea609c1458d547e43ec309561fde518f45f0820bb699f0c9a771cc9c3a2703b86086a3767c5e2d10bf829f2a668f8175f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un124478.exe

    Filesize

    660KB

    MD5

    e4e6d3640e0f4a3bb0dba13e2a6e50b1

    SHA1

    4f3f83398b34084cb327d3685681f21252346e49

    SHA256

    2b007d4cc02396a720a93b9c7cebe7de37c6fe3317251e41a3258d3b1ea3f5d6

    SHA512

    26b4948580639e92c6733a5a79e15a45e3a2512e065654f57642240ab7b982192177a563dd84ef3b0a89168ebff9760ced24b847562d0194ad7bc43cac12a51c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un124478.exe

    Filesize

    660KB

    MD5

    e4e6d3640e0f4a3bb0dba13e2a6e50b1

    SHA1

    4f3f83398b34084cb327d3685681f21252346e49

    SHA256

    2b007d4cc02396a720a93b9c7cebe7de37c6fe3317251e41a3258d3b1ea3f5d6

    SHA512

    26b4948580639e92c6733a5a79e15a45e3a2512e065654f57642240ab7b982192177a563dd84ef3b0a89168ebff9760ced24b847562d0194ad7bc43cac12a51c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081201.exe

    Filesize

    175KB

    MD5

    b2e599dec0856d70ebb2ab2327ae6442

    SHA1

    300323436b47ddafa78cb7e835deb1ab09f13698

    SHA256

    b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

    SHA512

    c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk081201.exe

    Filesize

    175KB

    MD5

    b2e599dec0856d70ebb2ab2327ae6442

    SHA1

    300323436b47ddafa78cb7e835deb1ab09f13698

    SHA256

    b1470330cd560723c67ad42eb7e8c8137271c5a729cd08a81d3028e8bb2e1c43

    SHA512

    c5092c0377c8d7aa8a1097d52e2b96df41ce9b1b9a72bf0c3a1f10c7c60ea5831bb2c535e144f1908f39f2b93017d69fd9f24272b0e706bacd5970e84e909065

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un707191.exe

    Filesize

    518KB

    MD5

    97d529a903c811fd5142c1436958e4bc

    SHA1

    4a77c88eb83f8b0cd132f9d4dbe8ed554c6c7d0d

    SHA256

    71fd6226001c707287ad6d7aae7d1174ad6aa21352c2ccbeff8c4402b2601bfa

    SHA512

    2ab8fb7b3198e64fcfb8215a7dc64b79e26f7b1dd4c1b2b0f0a965204cff37217e65cc5cf655d8c0c8bbd5d07ebcbdd6ac1ec456dc6269937ba76564512b2f0e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un707191.exe

    Filesize

    518KB

    MD5

    97d529a903c811fd5142c1436958e4bc

    SHA1

    4a77c88eb83f8b0cd132f9d4dbe8ed554c6c7d0d

    SHA256

    71fd6226001c707287ad6d7aae7d1174ad6aa21352c2ccbeff8c4402b2601bfa

    SHA512

    2ab8fb7b3198e64fcfb8215a7dc64b79e26f7b1dd4c1b2b0f0a965204cff37217e65cc5cf655d8c0c8bbd5d07ebcbdd6ac1ec456dc6269937ba76564512b2f0e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr239432.exe

    Filesize

    238KB

    MD5

    d265c39e6a330a862d7471deb8b1d862

    SHA1

    ae4029f1b8db6b055b4239e86e8e96b456917fbb

    SHA256

    4ec2fb806808d376d72f83d0c9a4ba35afaa58ef9f066b8d21b70d24dae8516e

    SHA512

    5689d72e9def89f1746b44668b5ccedbe7366fdc5d1fe7b05b128ff71327fd76f56c6a5430ab0c2262ab1dc869d3ffe22ad808cb771505e9c32b81cbff26599c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr239432.exe

    Filesize

    238KB

    MD5

    d265c39e6a330a862d7471deb8b1d862

    SHA1

    ae4029f1b8db6b055b4239e86e8e96b456917fbb

    SHA256

    4ec2fb806808d376d72f83d0c9a4ba35afaa58ef9f066b8d21b70d24dae8516e

    SHA512

    5689d72e9def89f1746b44668b5ccedbe7366fdc5d1fe7b05b128ff71327fd76f56c6a5430ab0c2262ab1dc869d3ffe22ad808cb771505e9c32b81cbff26599c

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu160502.exe

    Filesize

    297KB

    MD5

    719ab766f5df705c5acad58ec3844c1b

    SHA1

    d845969ba7885e5f9a484d1cb36cdfba5fc2d885

    SHA256

    0ee5a7e86c29e6dd99bd5f4485dcb53ad6788663901901071d612ac8ed4fbc0c

    SHA512

    fd1d5ac9220df4419505528e37d65bf7a709ca6b9b1547f8520bd59e3975ab2aaead6c9c42a12a71b431308bf4e16d61561ea849019fb5044242f1d5bee50366

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu160502.exe

    Filesize

    297KB

    MD5

    719ab766f5df705c5acad58ec3844c1b

    SHA1

    d845969ba7885e5f9a484d1cb36cdfba5fc2d885

    SHA256

    0ee5a7e86c29e6dd99bd5f4485dcb53ad6788663901901071d612ac8ed4fbc0c

    SHA512

    fd1d5ac9220df4419505528e37d65bf7a709ca6b9b1547f8520bd59e3975ab2aaead6c9c42a12a71b431308bf4e16d61561ea849019fb5044242f1d5bee50366

  • memory/1692-1122-0x0000000000580000-0x00000000005BB000-memory.dmp

    Filesize

    236KB

  • memory/2552-1095-0x00000000057C0000-0x00000000057FE000-memory.dmp

    Filesize

    248KB

  • memory/2552-207-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-1108-0x0000000006610000-0x0000000006B3C000-memory.dmp

    Filesize

    5.2MB

  • memory/2552-1107-0x0000000006430000-0x00000000065F2000-memory.dmp

    Filesize

    1.8MB

  • memory/2552-1106-0x00000000062B0000-0x0000000006300000-memory.dmp

    Filesize

    320KB

  • memory/2552-1105-0x0000000006230000-0x00000000062A6000-memory.dmp

    Filesize

    472KB

  • memory/2552-1104-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-1103-0x0000000006170000-0x0000000006202000-memory.dmp

    Filesize

    584KB

  • memory/2552-1102-0x0000000005AA0000-0x0000000005B06000-memory.dmp

    Filesize

    408KB

  • memory/2552-1101-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-1100-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-1099-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-1097-0x0000000005910000-0x000000000595B000-memory.dmp

    Filesize

    300KB

  • memory/2552-1096-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-1094-0x00000000057A0000-0x00000000057B2000-memory.dmp

    Filesize

    72KB

  • memory/2552-1093-0x0000000004B40000-0x0000000004C4A000-memory.dmp

    Filesize

    1.0MB

  • memory/2552-1092-0x0000000005190000-0x0000000005796000-memory.dmp

    Filesize

    6.0MB

  • memory/2552-180-0x0000000002140000-0x0000000002186000-memory.dmp

    Filesize

    280KB

  • memory/2552-181-0x00000000023F0000-0x0000000002434000-memory.dmp

    Filesize

    272KB

  • memory/2552-182-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-183-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-185-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-187-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-189-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-191-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-193-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-195-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-197-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-199-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-201-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-203-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-204-0x00000000004C0000-0x000000000050B000-memory.dmp

    Filesize

    300KB

  • memory/2552-208-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-219-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-206-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-211-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-209-0x0000000004C80000-0x0000000004C90000-memory.dmp

    Filesize

    64KB

  • memory/2552-213-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-215-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2552-217-0x00000000023F0000-0x000000000242F000-memory.dmp

    Filesize

    252KB

  • memory/2900-160-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-162-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-148-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-175-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/2900-145-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-173-0x0000000000400000-0x00000000004AA000-memory.dmp

    Filesize

    680KB

  • memory/2900-172-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-170-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-168-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-166-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-164-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-142-0x0000000004A20000-0x0000000004A30000-memory.dmp

    Filesize

    64KB

  • memory/2900-146-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-156-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-150-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-154-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-152-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/2900-144-0x00000000049D0000-0x00000000049E8000-memory.dmp

    Filesize

    96KB

  • memory/2900-143-0x0000000004A30000-0x0000000004F2E000-memory.dmp

    Filesize

    5.0MB

  • memory/2900-140-0x0000000000580000-0x00000000005AD000-memory.dmp

    Filesize

    180KB

  • memory/2900-141-0x0000000002330000-0x000000000234A000-memory.dmp

    Filesize

    104KB

  • memory/2900-158-0x00000000049D0000-0x00000000049E2000-memory.dmp

    Filesize

    72KB

  • memory/3672-1116-0x0000000004F40000-0x0000000004F50000-memory.dmp

    Filesize

    64KB

  • memory/3672-1115-0x0000000004DE0000-0x0000000004E2B000-memory.dmp

    Filesize

    300KB

  • memory/3672-1114-0x00000000003A0000-0x00000000003D2000-memory.dmp

    Filesize

    200KB