Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    182s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 18:31

General

  • Target

    733d8bcb05833b65beb9b763372015e736cbeccb862713d28a1af85133883258.exe

  • Size

    923KB

  • MD5

    369dd19e2de592c1ebcf3dfa485d6263

  • SHA1

    13b2e7711fa301501b7807d17179a56ee4345ab6

  • SHA256

    733d8bcb05833b65beb9b763372015e736cbeccb862713d28a1af85133883258

  • SHA512

    79f86238a2782773f857d34f88dc80ed4654b56b6df66222895b216a7e1c09d3bed85338d1e8c340007679c311818a650f87eea66e36017cda3b07b607df8129

  • SSDEEP

    24576:jycUoLYxjH2eD6nPT4prEKoEXtjtIcb8mje4LT:2cr6+nPTErE9ctjXLfL

Malware Config

Extracted

Family

redline

Botnet

lupa

C2

217.196.96.56:4138

Attributes
  • auth_value

    fcb02fce9bc10c56a9841d56974bd7b8

Signatures

  • Detects Redline Stealer samples 3 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\733d8bcb05833b65beb9b763372015e736cbeccb862713d28a1af85133883258.exe
    "C:\Users\Admin\AppData\Local\Temp\733d8bcb05833b65beb9b763372015e736cbeccb862713d28a1af85133883258.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6441614.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6441614.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2664
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9957744.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9957744.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9796849.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9796849.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1504
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n9855826.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n9855826.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:652
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 652 -s 1084
              6⤵
              • Program crash
              PID:4296
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o4132079.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o4132079.exe
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4612
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8874409.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8874409.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4888
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 652 -ip 652
    1⤵
      PID:4496

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6441614.exe

      Filesize

      769KB

      MD5

      413163f4e46dd435d1f17d80f2c58021

      SHA1

      b17e7d086aa1b06b52874399ec01f2f66a048ed0

      SHA256

      b8288ff8eb063f4d2ffc85ce5a1a8c8559c401fbd99a6dbaded188c7aed04bef

      SHA512

      3b069f239dba1b357724358be5faf763cc5b9b25cba4a622afb00e78ae2a76535090ce5cbd1c1f9ae97ec9fcaf368c5a0d7d9f8e3d5d846d1af36fa974253a53

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6441614.exe

      Filesize

      769KB

      MD5

      413163f4e46dd435d1f17d80f2c58021

      SHA1

      b17e7d086aa1b06b52874399ec01f2f66a048ed0

      SHA256

      b8288ff8eb063f4d2ffc85ce5a1a8c8559c401fbd99a6dbaded188c7aed04bef

      SHA512

      3b069f239dba1b357724358be5faf763cc5b9b25cba4a622afb00e78ae2a76535090ce5cbd1c1f9ae97ec9fcaf368c5a0d7d9f8e3d5d846d1af36fa974253a53

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9957744.exe

      Filesize

      587KB

      MD5

      792660dbe092c75455a61c6f78e20ebe

      SHA1

      f2f64c68dd980dac2278a56b1c93496e6ad72582

      SHA256

      aa49c51f8a6906c697a1050519157f47ab62a376d0ac78a4933e39776da6e123

      SHA512

      7797d0b5220e94b17e75ed7358bbcb118f8a396a18d15964bc137ac7b641ebf2d828bb6a9ca2349a898bd2505378fff8570513d99b1956fa098837ba11011f2a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9957744.exe

      Filesize

      587KB

      MD5

      792660dbe092c75455a61c6f78e20ebe

      SHA1

      f2f64c68dd980dac2278a56b1c93496e6ad72582

      SHA256

      aa49c51f8a6906c697a1050519157f47ab62a376d0ac78a4933e39776da6e123

      SHA512

      7797d0b5220e94b17e75ed7358bbcb118f8a396a18d15964bc137ac7b641ebf2d828bb6a9ca2349a898bd2505378fff8570513d99b1956fa098837ba11011f2a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8874409.exe

      Filesize

      176KB

      MD5

      c4db88375027c7c66e95d03dd4526c3e

      SHA1

      ff4aa28fc710e8058c6c06d7d4441bae93a7ce21

      SHA256

      35f4385b990aa71ce19c2a3351d8960fa5023ad5241d9d36049f1a6541acda17

      SHA512

      8ee29defc8f0a609b1debd20c6a331708ecd0f9847e6068fc646b3f99083b54a23c229206360d292a4b06408e028d7c7b5a100a6a8199d7293490716e26333ec

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p8874409.exe

      Filesize

      176KB

      MD5

      c4db88375027c7c66e95d03dd4526c3e

      SHA1

      ff4aa28fc710e8058c6c06d7d4441bae93a7ce21

      SHA256

      35f4385b990aa71ce19c2a3351d8960fa5023ad5241d9d36049f1a6541acda17

      SHA512

      8ee29defc8f0a609b1debd20c6a331708ecd0f9847e6068fc646b3f99083b54a23c229206360d292a4b06408e028d7c7b5a100a6a8199d7293490716e26333ec

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9796849.exe

      Filesize

      383KB

      MD5

      c134a451fbe206b0b2fa73823c856390

      SHA1

      a6db68b36f600c53e3e5229d63cbc80f5e8604b6

      SHA256

      2bcb88c1ffc4493189cc176c06e179855073dcda0beb7d7ae88125fa5a8f20d4

      SHA512

      57dcc1fbb688d7c0ee149e0cd4260766b144027cc139f7bee6cb1b2c1eaa41a22aa64dbe252bb33201bd529ddc307db2843e8f29dbbf50eac5cd26869f36b625

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9796849.exe

      Filesize

      383KB

      MD5

      c134a451fbe206b0b2fa73823c856390

      SHA1

      a6db68b36f600c53e3e5229d63cbc80f5e8604b6

      SHA256

      2bcb88c1ffc4493189cc176c06e179855073dcda0beb7d7ae88125fa5a8f20d4

      SHA512

      57dcc1fbb688d7c0ee149e0cd4260766b144027cc139f7bee6cb1b2c1eaa41a22aa64dbe252bb33201bd529ddc307db2843e8f29dbbf50eac5cd26869f36b625

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n9855826.exe

      Filesize

      283KB

      MD5

      1f87643424d8b50f39bdcd92dec27b36

      SHA1

      36d48898f13e9f6c6e68fd418b193fa2a36270ae

      SHA256

      c47551e49b0b99619830b20320d2af357502d99eb25dfaeabf0f5a1c136eec10

      SHA512

      e72f1e43cf7c12b2fdbdca5093672a98b335c9a50116f13efd414d14ef5979f9c45c7f9604c2b065c8bf984a68e952e7067f06398c124a85602eaee971cc4f59

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\n9855826.exe

      Filesize

      283KB

      MD5

      1f87643424d8b50f39bdcd92dec27b36

      SHA1

      36d48898f13e9f6c6e68fd418b193fa2a36270ae

      SHA256

      c47551e49b0b99619830b20320d2af357502d99eb25dfaeabf0f5a1c136eec10

      SHA512

      e72f1e43cf7c12b2fdbdca5093672a98b335c9a50116f13efd414d14ef5979f9c45c7f9604c2b065c8bf984a68e952e7067f06398c124a85602eaee971cc4f59

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o4132079.exe

      Filesize

      168KB

      MD5

      a62c904d5dfe22a4c9bd971439d88d2c

      SHA1

      fb3475834f9600d476123724a8e31674077d974c

      SHA256

      8395865a2f9f84abeecafc72d7b033c977c5ece997a12bb4576352bf609982c6

      SHA512

      486257a2340ab7b86038dda5bbd0bfdd3eb4b6a0ba1b9125c764e64f5a1c8eaa40bf816b770a6c791b369f8c4a944c90b3f6616690ade6745795f0691c93284a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o4132079.exe

      Filesize

      168KB

      MD5

      a62c904d5dfe22a4c9bd971439d88d2c

      SHA1

      fb3475834f9600d476123724a8e31674077d974c

      SHA256

      8395865a2f9f84abeecafc72d7b033c977c5ece997a12bb4576352bf609982c6

      SHA512

      486257a2340ab7b86038dda5bbd0bfdd3eb4b6a0ba1b9125c764e64f5a1c8eaa40bf816b770a6c791b369f8c4a944c90b3f6616690ade6745795f0691c93284a

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\o4132079.exe

      Filesize

      168KB

      MD5

      a62c904d5dfe22a4c9bd971439d88d2c

      SHA1

      fb3475834f9600d476123724a8e31674077d974c

      SHA256

      8395865a2f9f84abeecafc72d7b033c977c5ece997a12bb4576352bf609982c6

      SHA512

      486257a2340ab7b86038dda5bbd0bfdd3eb4b6a0ba1b9125c764e64f5a1c8eaa40bf816b770a6c791b369f8c4a944c90b3f6616690ade6745795f0691c93284a

    • memory/652-183-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-195-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-164-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/652-165-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/652-167-0x0000000000400000-0x00000000006C7000-memory.dmp

      Filesize

      2.8MB

    • memory/652-166-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-168-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-171-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-173-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-175-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-177-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-179-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-181-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-162-0x0000000004D40000-0x00000000052E4000-memory.dmp

      Filesize

      5.6MB

    • memory/652-185-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-187-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-189-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-191-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-193-0x0000000002440000-0x0000000002452000-memory.dmp

      Filesize

      72KB

    • memory/652-163-0x00000000007A0000-0x00000000007CD000-memory.dmp

      Filesize

      180KB

    • memory/652-196-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/652-197-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/652-198-0x0000000004D30000-0x0000000004D40000-memory.dmp

      Filesize

      64KB

    • memory/652-203-0x0000000000400000-0x00000000006C7000-memory.dmp

      Filesize

      2.8MB

    • memory/4612-219-0x000000000A6C0000-0x000000000A752000-memory.dmp

      Filesize

      584KB

    • memory/4612-220-0x000000000B0B0000-0x000000000B116000-memory.dmp

      Filesize

      408KB

    • memory/4612-213-0x000000000A400000-0x000000000A50A000-memory.dmp

      Filesize

      1.0MB

    • memory/4612-214-0x000000000A330000-0x000000000A342000-memory.dmp

      Filesize

      72KB

    • memory/4612-215-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

      Filesize

      64KB

    • memory/4612-216-0x000000000A390000-0x000000000A3CC000-memory.dmp

      Filesize

      240KB

    • memory/4612-212-0x000000000A890000-0x000000000AEA8000-memory.dmp

      Filesize

      6.1MB

    • memory/4612-217-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

      Filesize

      64KB

    • memory/4612-211-0x0000000000480000-0x00000000004AE000-memory.dmp

      Filesize

      184KB

    • memory/4612-218-0x0000000004D70000-0x0000000004DE6000-memory.dmp

      Filesize

      472KB

    • memory/4612-221-0x000000000B2F0000-0x000000000B340000-memory.dmp

      Filesize

      320KB

    • memory/4612-222-0x000000000BCE0000-0x000000000BEA2000-memory.dmp

      Filesize

      1.8MB

    • memory/4612-223-0x000000000C3E0000-0x000000000C90C000-memory.dmp

      Filesize

      5.2MB

    • memory/4888-256-0x0000000004960000-0x0000000004970000-memory.dmp

      Filesize

      64KB

    • memory/4888-257-0x0000000004960000-0x0000000004970000-memory.dmp

      Filesize

      64KB

    • memory/4888-258-0x0000000004960000-0x0000000004970000-memory.dmp

      Filesize

      64KB