Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 18:28

General

  • Target

    cec7c79800544354c74bde5f22f8d28a771acd4ea50941b947bae6fa0c060cfc.exe

  • Size

    1.5MB

  • MD5

    269029049604046a45066714cbba7f2a

  • SHA1

    f70ff2dbf1183716796f090f86c479a8e3e97ca7

  • SHA256

    cec7c79800544354c74bde5f22f8d28a771acd4ea50941b947bae6fa0c060cfc

  • SHA512

    e0a5959de75af85bbe20095f1024f497a4ba036a53e4a574c8a8ff526f265f0d7ebd76a7aceaa987d5197fe0a39746b88b05295253737905219ee6492a00b2d5

  • SSDEEP

    24576:GyP3owDEVPILVh+EyOcc8YA/huIBXYMLaBldu9acvsoMf0iySBWJbUiVbTx0YeMI:VPYw4VgBUvmDKvBoMOloQcvsoykXJbUk

Malware Config

Extracted

Family

redline

Botnet

most

C2

185.161.248.73:4164

Attributes
  • auth_value

    7da4dfa153f2919e617aa016f7c36008

Signatures

  • Detects Redline Stealer samples 3 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cec7c79800544354c74bde5f22f8d28a771acd4ea50941b947bae6fa0c060cfc.exe
    "C:\Users\Admin\AppData\Local\Temp\cec7c79800544354c74bde5f22f8d28a771acd4ea50941b947bae6fa0c060cfc.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4384
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i75715560.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i75715560.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1308
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i54396521.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i54396521.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41031967.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41031967.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1636
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i59672888.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i59672888.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1168
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73352756.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73352756.exe
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3508
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74863860.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74863860.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              PID:4516
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 696
                7⤵
                • Program crash
                PID:4540
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 748
                7⤵
                • Program crash
                PID:4304
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 856
                7⤵
                • Program crash
                PID:4676
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 864
                7⤵
                • Program crash
                PID:1804
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 996
                7⤵
                • Program crash
                PID:804
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 904
                7⤵
                • Program crash
                PID:1980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1216
                7⤵
                • Program crash
                PID:2460
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1240
                7⤵
                • Program crash
                PID:5108
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1268
                7⤵
                • Program crash
                PID:4220
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 1344
                7⤵
                • Program crash
                PID:532
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4516 -ip 4516
    1⤵
      PID:4392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4516 -ip 4516
      1⤵
        PID:5112
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4516 -ip 4516
        1⤵
          PID:3924
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4516 -ip 4516
          1⤵
            PID:4956
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4516 -ip 4516
            1⤵
              PID:3604
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4516 -ip 4516
              1⤵
                PID:4608
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4516 -ip 4516
                1⤵
                  PID:2932
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4516 -ip 4516
                  1⤵
                    PID:4032
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4516 -ip 4516
                    1⤵
                      PID:464
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4516 -ip 4516
                      1⤵
                        PID:1628

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i75715560.exe

                        Filesize

                        1.3MB

                        MD5

                        b2d7411a73c1631c2852111e65be6c79

                        SHA1

                        c79afc7a544fb9c890e76b2c89a95e1ef8136f2f

                        SHA256

                        fea6e3e26316aa989540965a9841f2020556e804b952db74bfe566e98821ccca

                        SHA512

                        ef3b6a1a6efeeae53be51289a607d45271e58d31f318c5a4b7b7974c91b08810ac5fa18d059f04f9e01a64386380f598647135437f2465705c08b6fd9a219f4f

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i75715560.exe

                        Filesize

                        1.3MB

                        MD5

                        b2d7411a73c1631c2852111e65be6c79

                        SHA1

                        c79afc7a544fb9c890e76b2c89a95e1ef8136f2f

                        SHA256

                        fea6e3e26316aa989540965a9841f2020556e804b952db74bfe566e98821ccca

                        SHA512

                        ef3b6a1a6efeeae53be51289a607d45271e58d31f318c5a4b7b7974c91b08810ac5fa18d059f04f9e01a64386380f598647135437f2465705c08b6fd9a219f4f

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i54396521.exe

                        Filesize

                        1016KB

                        MD5

                        b21bb611d7116a53533b54458bbd3b22

                        SHA1

                        5bad63367f02f851b0e434205176c063dfa173be

                        SHA256

                        e755c516a9749281d68cdb689bdffd6c569a04d658a7a79c9e58fd0af9166960

                        SHA512

                        7b4e76b952766cdc51cca6e54c80556d6aefab87c9156c81cb0630b289fcb440d5667a763332da5e800fc6b3d502c289226ad0b89fc64b04818b9574d7bfb4a9

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i54396521.exe

                        Filesize

                        1016KB

                        MD5

                        b21bb611d7116a53533b54458bbd3b22

                        SHA1

                        5bad63367f02f851b0e434205176c063dfa173be

                        SHA256

                        e755c516a9749281d68cdb689bdffd6c569a04d658a7a79c9e58fd0af9166960

                        SHA512

                        7b4e76b952766cdc51cca6e54c80556d6aefab87c9156c81cb0630b289fcb440d5667a763332da5e800fc6b3d502c289226ad0b89fc64b04818b9574d7bfb4a9

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41031967.exe

                        Filesize

                        844KB

                        MD5

                        84976b6b9e1d1ac3ceb02cb1e87d020d

                        SHA1

                        fbd2563b28d22bb409dc75b43bac65e060658801

                        SHA256

                        66ca5e387f94ba5be72326ebdfd67ffef14092dd0a563a9dbefc90a75b97ad34

                        SHA512

                        e3b0ca511ab7043b2c220fe0b12c1f9ed1adb1c39078023b520c4b7dfa0dd8c9fb631d663abb6b9e852857ffde3da6966c44e61eb226132d810863727794b044

                      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i41031967.exe

                        Filesize

                        844KB

                        MD5

                        84976b6b9e1d1ac3ceb02cb1e87d020d

                        SHA1

                        fbd2563b28d22bb409dc75b43bac65e060658801

                        SHA256

                        66ca5e387f94ba5be72326ebdfd67ffef14092dd0a563a9dbefc90a75b97ad34

                        SHA512

                        e3b0ca511ab7043b2c220fe0b12c1f9ed1adb1c39078023b520c4b7dfa0dd8c9fb631d663abb6b9e852857ffde3da6966c44e61eb226132d810863727794b044

                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i59672888.exe

                        Filesize

                        371KB

                        MD5

                        8f875afd6d45795592deed95d7df5a42

                        SHA1

                        beb05532ef90359890eae3ef672b3e8c990901e9

                        SHA256

                        bb5919ed68967941abbb48da392771c40121b38ab1ca5f0778cb5327a1a168d7

                        SHA512

                        a1bded274bfb6e623c27a0ca2b993bb263294c73896dbaa9d68baab35e906186cb323bd159893eab5a991e7bd909aa9678b584fe61ebf6ac4715e22c7a485211

                      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i59672888.exe

                        Filesize

                        371KB

                        MD5

                        8f875afd6d45795592deed95d7df5a42

                        SHA1

                        beb05532ef90359890eae3ef672b3e8c990901e9

                        SHA256

                        bb5919ed68967941abbb48da392771c40121b38ab1ca5f0778cb5327a1a168d7

                        SHA512

                        a1bded274bfb6e623c27a0ca2b993bb263294c73896dbaa9d68baab35e906186cb323bd159893eab5a991e7bd909aa9678b584fe61ebf6ac4715e22c7a485211

                      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73352756.exe

                        Filesize

                        169KB

                        MD5

                        938dfcf08cafbd962de85bae2093f403

                        SHA1

                        60c9dc4174632462942d8c4849eb9c16d60bd528

                        SHA256

                        c976899d878cd3a326428102188998a8986fc64d2462edf68df3538b2fee722b

                        SHA512

                        2b40b62fe7cce25d915b0fe0528dda213ce3758c0591b65557bc5e8862d1528833682ea0f37d6c5c123c2e1b20382e58317bb8e2825179dd22bc0d8d30b24d73

                      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a73352756.exe

                        Filesize

                        169KB

                        MD5

                        938dfcf08cafbd962de85bae2093f403

                        SHA1

                        60c9dc4174632462942d8c4849eb9c16d60bd528

                        SHA256

                        c976899d878cd3a326428102188998a8986fc64d2462edf68df3538b2fee722b

                        SHA512

                        2b40b62fe7cce25d915b0fe0528dda213ce3758c0591b65557bc5e8862d1528833682ea0f37d6c5c123c2e1b20382e58317bb8e2825179dd22bc0d8d30b24d73

                      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74863860.exe

                        Filesize

                        296KB

                        MD5

                        86b3e6b241e48a46055bc4403e881068

                        SHA1

                        1dde12952777ad1964564f3f92e04c21408c7614

                        SHA256

                        454263883787ccfb00dec16e5bdbe478125d5146f5149f2a3593ffb9794e1ee5

                        SHA512

                        99b0e87504e70aed844738f12e5a087deb8af25e9fbbf19e4482ac0aa4fdc2a107b2671dce0851beeb79f3c8b1d34dd97a1fbade957c0504d135f7edece32724

                      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b74863860.exe

                        Filesize

                        296KB

                        MD5

                        86b3e6b241e48a46055bc4403e881068

                        SHA1

                        1dde12952777ad1964564f3f92e04c21408c7614

                        SHA256

                        454263883787ccfb00dec16e5bdbe478125d5146f5149f2a3593ffb9794e1ee5

                        SHA512

                        99b0e87504e70aed844738f12e5a087deb8af25e9fbbf19e4482ac0aa4fdc2a107b2671dce0851beeb79f3c8b1d34dd97a1fbade957c0504d135f7edece32724

                      • memory/3508-173-0x000000000A550000-0x000000000A58C000-memory.dmp

                        Filesize

                        240KB

                      • memory/3508-180-0x000000000B6C0000-0x000000000B710000-memory.dmp

                        Filesize

                        320KB

                      • memory/3508-171-0x000000000A5C0000-0x000000000A6CA000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/3508-174-0x0000000004F20000-0x0000000004F30000-memory.dmp

                        Filesize

                        64KB

                      • memory/3508-175-0x0000000004F20000-0x0000000004F30000-memory.dmp

                        Filesize

                        64KB

                      • memory/3508-176-0x000000000B230000-0x000000000B2A6000-memory.dmp

                        Filesize

                        472KB

                      • memory/3508-177-0x000000000B350000-0x000000000B3E2000-memory.dmp

                        Filesize

                        584KB

                      • memory/3508-178-0x000000000B9A0000-0x000000000BF44000-memory.dmp

                        Filesize

                        5.6MB

                      • memory/3508-179-0x000000000B3F0000-0x000000000B456000-memory.dmp

                        Filesize

                        408KB

                      • memory/3508-172-0x000000000A4F0000-0x000000000A502000-memory.dmp

                        Filesize

                        72KB

                      • memory/3508-181-0x000000000BF50000-0x000000000C112000-memory.dmp

                        Filesize

                        1.8MB

                      • memory/3508-182-0x000000000C650000-0x000000000CB7C000-memory.dmp

                        Filesize

                        5.2MB

                      • memory/3508-170-0x000000000AA40000-0x000000000B058000-memory.dmp

                        Filesize

                        6.1MB

                      • memory/3508-169-0x0000000000640000-0x0000000000670000-memory.dmp

                        Filesize

                        192KB

                      • memory/4516-188-0x00000000008C0000-0x00000000008F5000-memory.dmp

                        Filesize

                        212KB

                      • memory/4516-189-0x0000000000400000-0x00000000007F0000-memory.dmp

                        Filesize

                        3.9MB

                      • memory/4516-190-0x00000000008C0000-0x00000000008F5000-memory.dmp

                        Filesize

                        212KB