Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2023, 04:51

General

  • Target

    c4269a19aa754636c5b4205ee988ba318b55deac407eb5fc6df07a62761c0c6f.exe

  • Size

    567KB

  • MD5

    43bda3e9635eb002fbb62370c27c4ef4

  • SHA1

    2bccd8a84d2304558e3149da74737741aab834ff

  • SHA256

    c4269a19aa754636c5b4205ee988ba318b55deac407eb5fc6df07a62761c0c6f

  • SHA512

    6ec6ba710510fb0aa2a2695932a4ca6b35023d76ad14190ea73778168a30a6fd1820bf3324ffeaa53a4a87d9a730d3cbe534c260921f64d05b81186ff48b3d04

  • SSDEEP

    12288:AMrAy90BZwjgv12SUEHPzzWXPDoqr37/VdsACPnA5K:QyeGo2gz4PDH/XfK

Malware Config

Extracted

Family

redline

Botnet

daris

C2

217.196.96.56:4138

Attributes
  • auth_value

    3491f24ae0250969cd45ce4b3fe77549

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4269a19aa754636c5b4205ee988ba318b55deac407eb5fc6df07a62761c0c6f.exe
    "C:\Users\Admin\AppData\Local\Temp\c4269a19aa754636c5b4205ee988ba318b55deac407eb5fc6df07a62761c0c6f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9586005.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9586005.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2553610.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2553610.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1616
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9649911.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9649911.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2400
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 1084
          4⤵
          • Program crash
          PID:4556
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2877545.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2877545.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1840
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:1656
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4196
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4860
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:4620
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:3296
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:1208
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:4308
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:3900
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:1388
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2400 -ip 2400
                1⤵
                  PID:5048
                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:388
                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3600

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2877545.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i2877545.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9586005.exe

                  Filesize

                  395KB

                  MD5

                  2b41cbfc2d47bdb30d0854f282eeff7e

                  SHA1

                  83a7f5600ba692b1913f4fcf7bd70d5e590dd220

                  SHA256

                  caa225e3e3c56276a7098cdeae327f4b9eef7f677b617f9e08cd8fdfd01c8aaa

                  SHA512

                  7d2022317461184bf666019da201ad5ff4d8f453b912815f28715d4e7f34f969caeb7619bbcecbd8d745747305e8774fad2af1935a05949a3cb8867e4bf5b17c

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9586005.exe

                  Filesize

                  395KB

                  MD5

                  2b41cbfc2d47bdb30d0854f282eeff7e

                  SHA1

                  83a7f5600ba692b1913f4fcf7bd70d5e590dd220

                  SHA256

                  caa225e3e3c56276a7098cdeae327f4b9eef7f677b617f9e08cd8fdfd01c8aaa

                  SHA512

                  7d2022317461184bf666019da201ad5ff4d8f453b912815f28715d4e7f34f969caeb7619bbcecbd8d745747305e8774fad2af1935a05949a3cb8867e4bf5b17c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2553610.exe

                  Filesize

                  168KB

                  MD5

                  d8926ca7680dc0454fb349c27b3c8c63

                  SHA1

                  5ac2ad6e2830efb42126b4bb756fcd447d116d9e

                  SHA256

                  0a409f7e46155c834d7c306d40a33d4775007a2a65d2866e56dc58fcf2323f1b

                  SHA512

                  0dee320da01e0e6f7a96de76e41cfe4baf6a931b6939d02f9b3eeccd32d017263ef9aefa4de55e8bab73fb5f5835892fe1b10bbc2172b9f9cbdd5a782f785228

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g2553610.exe

                  Filesize

                  168KB

                  MD5

                  d8926ca7680dc0454fb349c27b3c8c63

                  SHA1

                  5ac2ad6e2830efb42126b4bb756fcd447d116d9e

                  SHA256

                  0a409f7e46155c834d7c306d40a33d4775007a2a65d2866e56dc58fcf2323f1b

                  SHA512

                  0dee320da01e0e6f7a96de76e41cfe4baf6a931b6939d02f9b3eeccd32d017263ef9aefa4de55e8bab73fb5f5835892fe1b10bbc2172b9f9cbdd5a782f785228

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9649911.exe

                  Filesize

                  315KB

                  MD5

                  0311e50396fa2bc913e7016a9754b9e8

                  SHA1

                  0f53322b474f7d6cbc637ce37414df304694c610

                  SHA256

                  52ec9231369594f7e2c01272a15d10363678d1b0fdef032edf93a8e0abb01c58

                  SHA512

                  fe5e01c56d3084983bff533d2a359b6ee8bcc001f6a9fcbf6a75884d3c55ac01446b1add97165941304d89c7068f2cf02233d5507f88fea56738ffc39e27c2d9

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h9649911.exe

                  Filesize

                  315KB

                  MD5

                  0311e50396fa2bc913e7016a9754b9e8

                  SHA1

                  0f53322b474f7d6cbc637ce37414df304694c610

                  SHA256

                  52ec9231369594f7e2c01272a15d10363678d1b0fdef032edf93a8e0abb01c58

                  SHA512

                  fe5e01c56d3084983bff533d2a359b6ee8bcc001f6a9fcbf6a75884d3c55ac01446b1add97165941304d89c7068f2cf02233d5507f88fea56738ffc39e27c2d9

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                  Filesize

                  206KB

                  MD5

                  dc00e861c500fc0ac49e9f5e4bded843

                  SHA1

                  778d1ec4dc35d41c078a6adfe205e6f1fa8cd64c

                  SHA256

                  03714d8ebb3e75e9ac54a23d70c61d185c8adf22de741b5bedd6a1307242d4ab

                  SHA512

                  58f9cff8dcdb49c7f97723f8a8ee8fb412697057bc089ff5683630b8c7b15e2b8e1d31f831d6443066e163683f4560066db45d86248d8633dd5f29da507c5dfb

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8451a2c5daa42b25333b1b2089c5ea39

                  SHA1

                  700cc99ec8d3113435e657070d2d6bde0a833adc

                  SHA256

                  b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                  SHA512

                  6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8451a2c5daa42b25333b1b2089c5ea39

                  SHA1

                  700cc99ec8d3113435e657070d2d6bde0a833adc

                  SHA256

                  b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                  SHA512

                  6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8451a2c5daa42b25333b1b2089c5ea39

                  SHA1

                  700cc99ec8d3113435e657070d2d6bde0a833adc

                  SHA256

                  b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                  SHA512

                  6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

                • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                  Filesize

                  162B

                  MD5

                  1b7c22a214949975556626d7217e9a39

                  SHA1

                  d01c97e2944166ed23e47e4a62ff471ab8fa031f

                  SHA256

                  340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                  SHA512

                  ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

                • memory/1616-152-0x000000000A0D0000-0x000000000A10C000-memory.dmp

                  Filesize

                  240KB

                • memory/1616-156-0x000000000A590000-0x000000000A5F6000-memory.dmp

                  Filesize

                  408KB

                • memory/1616-157-0x000000000ACF0000-0x000000000AD40000-memory.dmp

                  Filesize

                  320KB

                • memory/1616-158-0x000000000BAC0000-0x000000000BC82000-memory.dmp

                  Filesize

                  1.8MB

                • memory/1616-159-0x000000000C1C0000-0x000000000C6EC000-memory.dmp

                  Filesize

                  5.2MB

                • memory/1616-160-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

                  Filesize

                  64KB

                • memory/1616-155-0x000000000B240000-0x000000000B7E4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1616-154-0x000000000A4F0000-0x000000000A582000-memory.dmp

                  Filesize

                  584KB

                • memory/1616-153-0x000000000A3D0000-0x000000000A446000-memory.dmp

                  Filesize

                  472KB

                • memory/1616-151-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

                  Filesize

                  64KB

                • memory/1616-150-0x000000000A070000-0x000000000A082000-memory.dmp

                  Filesize

                  72KB

                • memory/1616-149-0x000000000A160000-0x000000000A26A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/1616-148-0x000000000A670000-0x000000000AC88000-memory.dmp

                  Filesize

                  6.1MB

                • memory/1616-147-0x00000000002F0000-0x000000000031E000-memory.dmp

                  Filesize

                  184KB

                • memory/2400-171-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-183-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-185-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-187-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-189-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-191-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-193-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-194-0x0000000000560000-0x000000000058D000-memory.dmp

                  Filesize

                  180KB

                • memory/2400-195-0x0000000002410000-0x0000000002420000-memory.dmp

                  Filesize

                  64KB

                • memory/2400-196-0x0000000002410000-0x0000000002420000-memory.dmp

                  Filesize

                  64KB

                • memory/2400-197-0x0000000000400000-0x0000000000485000-memory.dmp

                  Filesize

                  532KB

                • memory/2400-199-0x0000000002410000-0x0000000002420000-memory.dmp

                  Filesize

                  64KB

                • memory/2400-181-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-179-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-175-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-177-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-173-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-169-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-167-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-166-0x0000000002470000-0x0000000002482000-memory.dmp

                  Filesize

                  72KB

                • memory/2400-200-0x0000000002410000-0x0000000002420000-memory.dmp

                  Filesize

                  64KB

                • memory/2400-201-0x0000000002410000-0x0000000002420000-memory.dmp

                  Filesize

                  64KB

                • memory/2400-202-0x0000000000400000-0x0000000000485000-memory.dmp

                  Filesize

                  532KB