Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06/05/2023, 21:51
Static task
static1
Behavioral task
behavioral1
Sample
4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe
Resource
win10v2004-20230220-en
General
-
Target
4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe
-
Size
1.5MB
-
MD5
08320187f21fb5cf492cb6d7b5fa4a63
-
SHA1
57d9e2c827dbd191f5685cac16574cfe5f775f89
-
SHA256
4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a
-
SHA512
1330b899685bc704e23d3aafc256e1a4bce6faad006d429a240da5b336a165931db1eac2c4e4688e077509b16e31d59acb96beee1f7107fb653c65afba896abf
-
SSDEEP
24576:yyN9xNl8iZESo+gsTfEIyOp1xl229gvuoHxFNPWN83rRHd9AQ0TpB8jhPDC7ND:ZrWyLTHTf+8175gmCuN87RHfy1ByDC7N
Malware Config
Extracted
redline
most
185.161.248.73:4164
-
auth_value
7da4dfa153f2919e617aa016f7c36008
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 5 IoCs
pid Process 1100 i33161819.exe 1200 i34355932.exe 772 i03483805.exe 1944 i51174381.exe 928 a56510896.exe -
Loads dropped DLL 10 IoCs
pid Process 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 1100 i33161819.exe 1100 i33161819.exe 1200 i34355932.exe 1200 i34355932.exe 772 i03483805.exe 772 i03483805.exe 1944 i51174381.exe 1944 i51174381.exe 928 a56510896.exe -
Adds Run key to start application 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" i33161819.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce i03483805.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce i51174381.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" i51174381.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce i33161819.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" i34355932.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" i03483805.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce i34355932.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1164 wrote to memory of 1100 1164 4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe 28 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1100 wrote to memory of 1200 1100 i33161819.exe 29 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 1200 wrote to memory of 772 1200 i34355932.exe 30 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 772 wrote to memory of 1944 772 i03483805.exe 31 PID 1944 wrote to memory of 928 1944 i51174381.exe 32 PID 1944 wrote to memory of 928 1944 i51174381.exe 32 PID 1944 wrote to memory of 928 1944 i51174381.exe 32 PID 1944 wrote to memory of 928 1944 i51174381.exe 32 PID 1944 wrote to memory of 928 1944 i51174381.exe 32 PID 1944 wrote to memory of 928 1944 i51174381.exe 32 PID 1944 wrote to memory of 928 1944 i51174381.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe"C:\Users\Admin\AppData\Local\Temp\4f65bab67edb5ba4ff853587b132200eef63b3d4aeccac1dd58a7d1ad7f73b9a.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i33161819.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i33161819.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i34355932.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\i34355932.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i03483805.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i03483805.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:772 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i51174381.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\i51174381.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a56510896.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a56510896.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD569111772edd7024089e596807203aaf3
SHA12e185fb1ebebfecc72d3d736cf4dc5641178e3fa
SHA256cb52f95f2ba9539221db6c71c0615635fec2fe3660f5aedcb1bf595b862b0d64
SHA51210fe8c403e7ff58d2645f7cac0f831790d484d2eb1151f5fdd3116a57bf03e676f89ab6703f587de25c8df0b51cac3e618d221c07287ee29bc8644b95130b44b
-
Filesize
1.3MB
MD569111772edd7024089e596807203aaf3
SHA12e185fb1ebebfecc72d3d736cf4dc5641178e3fa
SHA256cb52f95f2ba9539221db6c71c0615635fec2fe3660f5aedcb1bf595b862b0d64
SHA51210fe8c403e7ff58d2645f7cac0f831790d484d2eb1151f5fdd3116a57bf03e676f89ab6703f587de25c8df0b51cac3e618d221c07287ee29bc8644b95130b44b
-
Filesize
1014KB
MD5f7c8c00b729d76a9298ffad5166f41cd
SHA14e6f7b3704f9f4139167f6f65eaed826a6cfe891
SHA256329e4d841506d9beff8299bbff7f5d0cb477caf4b2a59d8f69b03b58c19ea97a
SHA5127cbcfa41b34e1a092fff5376683211cfe5055f03030f6288583790c79b99c11c6e288cb64f3d26cac6afdea9f50f694589e8190fc72b53e55add5861f0aa5406
-
Filesize
1014KB
MD5f7c8c00b729d76a9298ffad5166f41cd
SHA14e6f7b3704f9f4139167f6f65eaed826a6cfe891
SHA256329e4d841506d9beff8299bbff7f5d0cb477caf4b2a59d8f69b03b58c19ea97a
SHA5127cbcfa41b34e1a092fff5376683211cfe5055f03030f6288583790c79b99c11c6e288cb64f3d26cac6afdea9f50f694589e8190fc72b53e55add5861f0aa5406
-
Filesize
842KB
MD524a04ce69e3286222907c8c992117369
SHA14f8c456d8f4d42006ee06fa8e5a957cea7839441
SHA25656d4f7c11ed0bee078be58568ef16a8ce3a21f04936a438e961854913695fe9d
SHA512cb876a8f1160d7bbecadab86649173e6485f07a68151da254523df54133f9c69d8d19f29d99f9a150805038d5a2631d0c589b5997842a6b7ea30b3893294019b
-
Filesize
842KB
MD524a04ce69e3286222907c8c992117369
SHA14f8c456d8f4d42006ee06fa8e5a957cea7839441
SHA25656d4f7c11ed0bee078be58568ef16a8ce3a21f04936a438e961854913695fe9d
SHA512cb876a8f1160d7bbecadab86649173e6485f07a68151da254523df54133f9c69d8d19f29d99f9a150805038d5a2631d0c589b5997842a6b7ea30b3893294019b
-
Filesize
370KB
MD5060875bb9cab6d0d31157271ec96e92a
SHA1a513a64e221fa78c64cbc7c7af982a1d9be8abf6
SHA2560c9ef7668b2413d873ba2991393460c52fdc4c84cf481a090f8a724b84b5600d
SHA512bd6a5e749bbb28cfdb49e8979fc8d8f502707d0866d61b010ccd843c306fcd34aa026f8ad889e8f33a8a7ca3f8042c4806e699bf1b1e204eae9385bd481410e2
-
Filesize
370KB
MD5060875bb9cab6d0d31157271ec96e92a
SHA1a513a64e221fa78c64cbc7c7af982a1d9be8abf6
SHA2560c9ef7668b2413d873ba2991393460c52fdc4c84cf481a090f8a724b84b5600d
SHA512bd6a5e749bbb28cfdb49e8979fc8d8f502707d0866d61b010ccd843c306fcd34aa026f8ad889e8f33a8a7ca3f8042c4806e699bf1b1e204eae9385bd481410e2
-
Filesize
169KB
MD5a34e26a5d778240b8ce82c7077a3cc12
SHA1c2d9bd3e36cf367dec101b1b0aa47af55ce93045
SHA25666f94dad99ed4f9ef75cb30fa967dc2adddfb49a3305a87840ec2c69fa5089e0
SHA512442ebda93242b39b6e843ec105bd332d5bd59c30ea3ae95ffdc4eab36843acf8f97a0e02c5c08f5e62c2f4cbf34e6604766b747adf1ecc67c4ffbccb75f23cf2
-
Filesize
169KB
MD5a34e26a5d778240b8ce82c7077a3cc12
SHA1c2d9bd3e36cf367dec101b1b0aa47af55ce93045
SHA25666f94dad99ed4f9ef75cb30fa967dc2adddfb49a3305a87840ec2c69fa5089e0
SHA512442ebda93242b39b6e843ec105bd332d5bd59c30ea3ae95ffdc4eab36843acf8f97a0e02c5c08f5e62c2f4cbf34e6604766b747adf1ecc67c4ffbccb75f23cf2
-
Filesize
1.3MB
MD569111772edd7024089e596807203aaf3
SHA12e185fb1ebebfecc72d3d736cf4dc5641178e3fa
SHA256cb52f95f2ba9539221db6c71c0615635fec2fe3660f5aedcb1bf595b862b0d64
SHA51210fe8c403e7ff58d2645f7cac0f831790d484d2eb1151f5fdd3116a57bf03e676f89ab6703f587de25c8df0b51cac3e618d221c07287ee29bc8644b95130b44b
-
Filesize
1.3MB
MD569111772edd7024089e596807203aaf3
SHA12e185fb1ebebfecc72d3d736cf4dc5641178e3fa
SHA256cb52f95f2ba9539221db6c71c0615635fec2fe3660f5aedcb1bf595b862b0d64
SHA51210fe8c403e7ff58d2645f7cac0f831790d484d2eb1151f5fdd3116a57bf03e676f89ab6703f587de25c8df0b51cac3e618d221c07287ee29bc8644b95130b44b
-
Filesize
1014KB
MD5f7c8c00b729d76a9298ffad5166f41cd
SHA14e6f7b3704f9f4139167f6f65eaed826a6cfe891
SHA256329e4d841506d9beff8299bbff7f5d0cb477caf4b2a59d8f69b03b58c19ea97a
SHA5127cbcfa41b34e1a092fff5376683211cfe5055f03030f6288583790c79b99c11c6e288cb64f3d26cac6afdea9f50f694589e8190fc72b53e55add5861f0aa5406
-
Filesize
1014KB
MD5f7c8c00b729d76a9298ffad5166f41cd
SHA14e6f7b3704f9f4139167f6f65eaed826a6cfe891
SHA256329e4d841506d9beff8299bbff7f5d0cb477caf4b2a59d8f69b03b58c19ea97a
SHA5127cbcfa41b34e1a092fff5376683211cfe5055f03030f6288583790c79b99c11c6e288cb64f3d26cac6afdea9f50f694589e8190fc72b53e55add5861f0aa5406
-
Filesize
842KB
MD524a04ce69e3286222907c8c992117369
SHA14f8c456d8f4d42006ee06fa8e5a957cea7839441
SHA25656d4f7c11ed0bee078be58568ef16a8ce3a21f04936a438e961854913695fe9d
SHA512cb876a8f1160d7bbecadab86649173e6485f07a68151da254523df54133f9c69d8d19f29d99f9a150805038d5a2631d0c589b5997842a6b7ea30b3893294019b
-
Filesize
842KB
MD524a04ce69e3286222907c8c992117369
SHA14f8c456d8f4d42006ee06fa8e5a957cea7839441
SHA25656d4f7c11ed0bee078be58568ef16a8ce3a21f04936a438e961854913695fe9d
SHA512cb876a8f1160d7bbecadab86649173e6485f07a68151da254523df54133f9c69d8d19f29d99f9a150805038d5a2631d0c589b5997842a6b7ea30b3893294019b
-
Filesize
370KB
MD5060875bb9cab6d0d31157271ec96e92a
SHA1a513a64e221fa78c64cbc7c7af982a1d9be8abf6
SHA2560c9ef7668b2413d873ba2991393460c52fdc4c84cf481a090f8a724b84b5600d
SHA512bd6a5e749bbb28cfdb49e8979fc8d8f502707d0866d61b010ccd843c306fcd34aa026f8ad889e8f33a8a7ca3f8042c4806e699bf1b1e204eae9385bd481410e2
-
Filesize
370KB
MD5060875bb9cab6d0d31157271ec96e92a
SHA1a513a64e221fa78c64cbc7c7af982a1d9be8abf6
SHA2560c9ef7668b2413d873ba2991393460c52fdc4c84cf481a090f8a724b84b5600d
SHA512bd6a5e749bbb28cfdb49e8979fc8d8f502707d0866d61b010ccd843c306fcd34aa026f8ad889e8f33a8a7ca3f8042c4806e699bf1b1e204eae9385bd481410e2
-
Filesize
169KB
MD5a34e26a5d778240b8ce82c7077a3cc12
SHA1c2d9bd3e36cf367dec101b1b0aa47af55ce93045
SHA25666f94dad99ed4f9ef75cb30fa967dc2adddfb49a3305a87840ec2c69fa5089e0
SHA512442ebda93242b39b6e843ec105bd332d5bd59c30ea3ae95ffdc4eab36843acf8f97a0e02c5c08f5e62c2f4cbf34e6604766b747adf1ecc67c4ffbccb75f23cf2
-
Filesize
169KB
MD5a34e26a5d778240b8ce82c7077a3cc12
SHA1c2d9bd3e36cf367dec101b1b0aa47af55ce93045
SHA25666f94dad99ed4f9ef75cb30fa967dc2adddfb49a3305a87840ec2c69fa5089e0
SHA512442ebda93242b39b6e843ec105bd332d5bd59c30ea3ae95ffdc4eab36843acf8f97a0e02c5c08f5e62c2f4cbf34e6604766b747adf1ecc67c4ffbccb75f23cf2