Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    261s
  • max time network
    367s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    06/05/2023, 22:43

General

  • Target

    0691043dbf7247f369440bcb1a429e8df6ffd3457f30aac5e2820715f62537f3.exe

  • Size

    1.4MB

  • MD5

    5c5c81a650f941f0556c909020d75ea7

  • SHA1

    317c7551be7d2f76ffc0a368827a0e9a50ce47c3

  • SHA256

    0691043dbf7247f369440bcb1a429e8df6ffd3457f30aac5e2820715f62537f3

  • SHA512

    0088abf0ed9f8b9310ce1626008552eb7f206bbabf074fb7bb534d2bb91b41ff18034036f24f41225932ed4dd91cade1e5250ff875ab968a501448f48cf6d679

  • SSDEEP

    24576:/ymjwlunBYcCZyMcwrGHKCL1LSrAlC4TbzS/Qpi2PDZkNhupi5VM:Kmjwsxf9wKP1LSrMTbOQDaUpG

Malware Config

Extracted

Family

redline

Botnet

mask

C2

217.196.96.56:4138

Attributes
  • auth_value

    31aef25be0febb8e491794ef7f502c50

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 13 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0691043dbf7247f369440bcb1a429e8df6ffd3457f30aac5e2820715f62537f3.exe
    "C:\Users\Admin\AppData\Local\Temp\0691043dbf7247f369440bcb1a429e8df6ffd3457f30aac5e2820715f62537f3.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:580
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5954638.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5954638.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1072
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3854008.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3854008.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:700
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3243674.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3243674.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:884
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1416645.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1416645.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:556
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Loads dropped DLL
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:360
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2023792.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2023792.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5954638.exe

    Filesize

    1.3MB

    MD5

    39f390424af3c834a2fb34df1285f893

    SHA1

    afa8cd1c6e303f61c31fd9cdbad0f41eca083a78

    SHA256

    c0decc379fc0ea4b3cdff24d222db7127538004f7b98e13b4bc33ee2a63f5a44

    SHA512

    93404b77fbe3e1e1d5baf4d6303d64557b7f41d9e86e9a8f7054fe1be8e71c37ea9ed01d9b83bb0984b8d322599c6efd87a77169e6de47e7dfc1e20ce607302b

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v5954638.exe

    Filesize

    1.3MB

    MD5

    39f390424af3c834a2fb34df1285f893

    SHA1

    afa8cd1c6e303f61c31fd9cdbad0f41eca083a78

    SHA256

    c0decc379fc0ea4b3cdff24d222db7127538004f7b98e13b4bc33ee2a63f5a44

    SHA512

    93404b77fbe3e1e1d5baf4d6303d64557b7f41d9e86e9a8f7054fe1be8e71c37ea9ed01d9b83bb0984b8d322599c6efd87a77169e6de47e7dfc1e20ce607302b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3854008.exe

    Filesize

    846KB

    MD5

    4835642a1871bdb58b15c4d634170e54

    SHA1

    28ae24516568c58a0c9546388d1c9754514e1c55

    SHA256

    5d3c12499aaeafbd6985415b6adce1955ee4bdc6a09e00cd46f6d91bde666a78

    SHA512

    3463fd927b596017c61c62700e7d2a889c7c1bf378b1d8eddb293755755a733e09d4d2f44273bf349576cf25f3049275d2df4159faba52f80599ad294ea15bbc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v3854008.exe

    Filesize

    846KB

    MD5

    4835642a1871bdb58b15c4d634170e54

    SHA1

    28ae24516568c58a0c9546388d1c9754514e1c55

    SHA256

    5d3c12499aaeafbd6985415b6adce1955ee4bdc6a09e00cd46f6d91bde666a78

    SHA512

    3463fd927b596017c61c62700e7d2a889c7c1bf378b1d8eddb293755755a733e09d4d2f44273bf349576cf25f3049275d2df4159faba52f80599ad294ea15bbc

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3243674.exe

    Filesize

    641KB

    MD5

    66a4b4482761e46b6e499e132724ad90

    SHA1

    b99a595cd4147c513c30df1e42ed167d67db3c8b

    SHA256

    4a4dcf4fc6bad026498c56502a7d621e013001432545cf63c88103f1a7d140d3

    SHA512

    3d3f7f65a19029887a85596a76721ae7fbdd5b94fa070f468b8fc4363a5c806ec7cfad56dbe761ed0134fe7a29d66105abb297c1b0be32f5fbd391e179acf1be

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v3243674.exe

    Filesize

    641KB

    MD5

    66a4b4482761e46b6e499e132724ad90

    SHA1

    b99a595cd4147c513c30df1e42ed167d67db3c8b

    SHA256

    4a4dcf4fc6bad026498c56502a7d621e013001432545cf63c88103f1a7d140d3

    SHA512

    3d3f7f65a19029887a85596a76721ae7fbdd5b94fa070f468b8fc4363a5c806ec7cfad56dbe761ed0134fe7a29d66105abb297c1b0be32f5fbd391e179acf1be

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1416645.exe

    Filesize

    383KB

    MD5

    e9fb12c4cef4c40b376d35ee37385a1a

    SHA1

    178ec92941574b2f2d1e9480fd50e100c68f9e1d

    SHA256

    186035ac643913904f9db5b461d2b35a3ee0a5bfb271af3e84608d49daedb6d0

    SHA512

    f91b9c090e0214e72c6f5e9959b5b925c10c52e9e3b3db5188fb0575223e3f2faff8b024b997c111b58958f284ea81cf02926bfcded5eb9e4df50445de19d93f

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1416645.exe

    Filesize

    383KB

    MD5

    e9fb12c4cef4c40b376d35ee37385a1a

    SHA1

    178ec92941574b2f2d1e9480fd50e100c68f9e1d

    SHA256

    186035ac643913904f9db5b461d2b35a3ee0a5bfb271af3e84608d49daedb6d0

    SHA512

    f91b9c090e0214e72c6f5e9959b5b925c10c52e9e3b3db5188fb0575223e3f2faff8b024b997c111b58958f284ea81cf02926bfcded5eb9e4df50445de19d93f

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe

    Filesize

    289KB

    MD5

    3a237a6b7ad93e72b009a2c44c14c215

    SHA1

    90901129c255f6c1a0c4391ee8d7d782c4b38734

    SHA256

    1ca6f447d989782f3db7c7f3fa4813ceab3f734d2989b25eb46035338dcb0f01

    SHA512

    f3e7a104a9229e857ad6ff565ece45adbd7c43902e64f4e82e108111bab8ea6b8a2a3f5d89dafa42abbcf7baa5bd6d2685118793a365e213108f69557b62dd09

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe

    Filesize

    289KB

    MD5

    3a237a6b7ad93e72b009a2c44c14c215

    SHA1

    90901129c255f6c1a0c4391ee8d7d782c4b38734

    SHA256

    1ca6f447d989782f3db7c7f3fa4813ceab3f734d2989b25eb46035338dcb0f01

    SHA512

    f3e7a104a9229e857ad6ff565ece45adbd7c43902e64f4e82e108111bab8ea6b8a2a3f5d89dafa42abbcf7baa5bd6d2685118793a365e213108f69557b62dd09

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe

    Filesize

    289KB

    MD5

    3a237a6b7ad93e72b009a2c44c14c215

    SHA1

    90901129c255f6c1a0c4391ee8d7d782c4b38734

    SHA256

    1ca6f447d989782f3db7c7f3fa4813ceab3f734d2989b25eb46035338dcb0f01

    SHA512

    f3e7a104a9229e857ad6ff565ece45adbd7c43902e64f4e82e108111bab8ea6b8a2a3f5d89dafa42abbcf7baa5bd6d2685118793a365e213108f69557b62dd09

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2023792.exe

    Filesize

    168KB

    MD5

    90c79ba8c6d6512b08f4c636f77df522

    SHA1

    e3eb640989d37d5c6dfe554a1652f56810c1d13b

    SHA256

    6f443d3e6aa6ccbc6d6b2e98b0948dc448bd8ba19bdc17fcaa4621862f81bdc5

    SHA512

    9344a1f8ec9c0c1793babdb8564bc10699a950298091c3bb0c2e2687b70886770d90fe36aeaa273027b915a6a1928754e022706a7bd74bb36e53c8bf9719ac0a

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b2023792.exe

    Filesize

    168KB

    MD5

    90c79ba8c6d6512b08f4c636f77df522

    SHA1

    e3eb640989d37d5c6dfe554a1652f56810c1d13b

    SHA256

    6f443d3e6aa6ccbc6d6b2e98b0948dc448bd8ba19bdc17fcaa4621862f81bdc5

    SHA512

    9344a1f8ec9c0c1793babdb8564bc10699a950298091c3bb0c2e2687b70886770d90fe36aeaa273027b915a6a1928754e022706a7bd74bb36e53c8bf9719ac0a

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v5954638.exe

    Filesize

    1.3MB

    MD5

    39f390424af3c834a2fb34df1285f893

    SHA1

    afa8cd1c6e303f61c31fd9cdbad0f41eca083a78

    SHA256

    c0decc379fc0ea4b3cdff24d222db7127538004f7b98e13b4bc33ee2a63f5a44

    SHA512

    93404b77fbe3e1e1d5baf4d6303d64557b7f41d9e86e9a8f7054fe1be8e71c37ea9ed01d9b83bb0984b8d322599c6efd87a77169e6de47e7dfc1e20ce607302b

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\v5954638.exe

    Filesize

    1.3MB

    MD5

    39f390424af3c834a2fb34df1285f893

    SHA1

    afa8cd1c6e303f61c31fd9cdbad0f41eca083a78

    SHA256

    c0decc379fc0ea4b3cdff24d222db7127538004f7b98e13b4bc33ee2a63f5a44

    SHA512

    93404b77fbe3e1e1d5baf4d6303d64557b7f41d9e86e9a8f7054fe1be8e71c37ea9ed01d9b83bb0984b8d322599c6efd87a77169e6de47e7dfc1e20ce607302b

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v3854008.exe

    Filesize

    846KB

    MD5

    4835642a1871bdb58b15c4d634170e54

    SHA1

    28ae24516568c58a0c9546388d1c9754514e1c55

    SHA256

    5d3c12499aaeafbd6985415b6adce1955ee4bdc6a09e00cd46f6d91bde666a78

    SHA512

    3463fd927b596017c61c62700e7d2a889c7c1bf378b1d8eddb293755755a733e09d4d2f44273bf349576cf25f3049275d2df4159faba52f80599ad294ea15bbc

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\v3854008.exe

    Filesize

    846KB

    MD5

    4835642a1871bdb58b15c4d634170e54

    SHA1

    28ae24516568c58a0c9546388d1c9754514e1c55

    SHA256

    5d3c12499aaeafbd6985415b6adce1955ee4bdc6a09e00cd46f6d91bde666a78

    SHA512

    3463fd927b596017c61c62700e7d2a889c7c1bf378b1d8eddb293755755a733e09d4d2f44273bf349576cf25f3049275d2df4159faba52f80599ad294ea15bbc

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v3243674.exe

    Filesize

    641KB

    MD5

    66a4b4482761e46b6e499e132724ad90

    SHA1

    b99a595cd4147c513c30df1e42ed167d67db3c8b

    SHA256

    4a4dcf4fc6bad026498c56502a7d621e013001432545cf63c88103f1a7d140d3

    SHA512

    3d3f7f65a19029887a85596a76721ae7fbdd5b94fa070f468b8fc4363a5c806ec7cfad56dbe761ed0134fe7a29d66105abb297c1b0be32f5fbd391e179acf1be

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\v3243674.exe

    Filesize

    641KB

    MD5

    66a4b4482761e46b6e499e132724ad90

    SHA1

    b99a595cd4147c513c30df1e42ed167d67db3c8b

    SHA256

    4a4dcf4fc6bad026498c56502a7d621e013001432545cf63c88103f1a7d140d3

    SHA512

    3d3f7f65a19029887a85596a76721ae7fbdd5b94fa070f468b8fc4363a5c806ec7cfad56dbe761ed0134fe7a29d66105abb297c1b0be32f5fbd391e179acf1be

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\v1416645.exe

    Filesize

    383KB

    MD5

    e9fb12c4cef4c40b376d35ee37385a1a

    SHA1

    178ec92941574b2f2d1e9480fd50e100c68f9e1d

    SHA256

    186035ac643913904f9db5b461d2b35a3ee0a5bfb271af3e84608d49daedb6d0

    SHA512

    f91b9c090e0214e72c6f5e9959b5b925c10c52e9e3b3db5188fb0575223e3f2faff8b024b997c111b58958f284ea81cf02926bfcded5eb9e4df50445de19d93f

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\v1416645.exe

    Filesize

    383KB

    MD5

    e9fb12c4cef4c40b376d35ee37385a1a

    SHA1

    178ec92941574b2f2d1e9480fd50e100c68f9e1d

    SHA256

    186035ac643913904f9db5b461d2b35a3ee0a5bfb271af3e84608d49daedb6d0

    SHA512

    f91b9c090e0214e72c6f5e9959b5b925c10c52e9e3b3db5188fb0575223e3f2faff8b024b997c111b58958f284ea81cf02926bfcded5eb9e4df50445de19d93f

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe

    Filesize

    289KB

    MD5

    3a237a6b7ad93e72b009a2c44c14c215

    SHA1

    90901129c255f6c1a0c4391ee8d7d782c4b38734

    SHA256

    1ca6f447d989782f3db7c7f3fa4813ceab3f734d2989b25eb46035338dcb0f01

    SHA512

    f3e7a104a9229e857ad6ff565ece45adbd7c43902e64f4e82e108111bab8ea6b8a2a3f5d89dafa42abbcf7baa5bd6d2685118793a365e213108f69557b62dd09

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe

    Filesize

    289KB

    MD5

    3a237a6b7ad93e72b009a2c44c14c215

    SHA1

    90901129c255f6c1a0c4391ee8d7d782c4b38734

    SHA256

    1ca6f447d989782f3db7c7f3fa4813ceab3f734d2989b25eb46035338dcb0f01

    SHA512

    f3e7a104a9229e857ad6ff565ece45adbd7c43902e64f4e82e108111bab8ea6b8a2a3f5d89dafa42abbcf7baa5bd6d2685118793a365e213108f69557b62dd09

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\a1718313.exe

    Filesize

    289KB

    MD5

    3a237a6b7ad93e72b009a2c44c14c215

    SHA1

    90901129c255f6c1a0c4391ee8d7d782c4b38734

    SHA256

    1ca6f447d989782f3db7c7f3fa4813ceab3f734d2989b25eb46035338dcb0f01

    SHA512

    f3e7a104a9229e857ad6ff565ece45adbd7c43902e64f4e82e108111bab8ea6b8a2a3f5d89dafa42abbcf7baa5bd6d2685118793a365e213108f69557b62dd09

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\b2023792.exe

    Filesize

    168KB

    MD5

    90c79ba8c6d6512b08f4c636f77df522

    SHA1

    e3eb640989d37d5c6dfe554a1652f56810c1d13b

    SHA256

    6f443d3e6aa6ccbc6d6b2e98b0948dc448bd8ba19bdc17fcaa4621862f81bdc5

    SHA512

    9344a1f8ec9c0c1793babdb8564bc10699a950298091c3bb0c2e2687b70886770d90fe36aeaa273027b915a6a1928754e022706a7bd74bb36e53c8bf9719ac0a

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\b2023792.exe

    Filesize

    168KB

    MD5

    90c79ba8c6d6512b08f4c636f77df522

    SHA1

    e3eb640989d37d5c6dfe554a1652f56810c1d13b

    SHA256

    6f443d3e6aa6ccbc6d6b2e98b0948dc448bd8ba19bdc17fcaa4621862f81bdc5

    SHA512

    9344a1f8ec9c0c1793babdb8564bc10699a950298091c3bb0c2e2687b70886770d90fe36aeaa273027b915a6a1928754e022706a7bd74bb36e53c8bf9719ac0a

  • memory/360-116-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-140-0x0000000004CC0000-0x0000000004D00000-memory.dmp

    Filesize

    256KB

  • memory/360-112-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-118-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-120-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-122-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-124-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-126-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-128-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-130-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-132-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-134-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-136-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-138-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-139-0x0000000004CC0000-0x0000000004D00000-memory.dmp

    Filesize

    256KB

  • memory/360-114-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-141-0x0000000004CC0000-0x0000000004D00000-memory.dmp

    Filesize

    256KB

  • memory/360-142-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/360-143-0x0000000004CC0000-0x0000000004D00000-memory.dmp

    Filesize

    256KB

  • memory/360-144-0x0000000004CC0000-0x0000000004D00000-memory.dmp

    Filesize

    256KB

  • memory/360-145-0x0000000004CC0000-0x0000000004D00000-memory.dmp

    Filesize

    256KB

  • memory/360-150-0x0000000000400000-0x000000000047F000-memory.dmp

    Filesize

    508KB

  • memory/360-111-0x0000000000900000-0x0000000000912000-memory.dmp

    Filesize

    72KB

  • memory/360-110-0x0000000000900000-0x0000000000918000-memory.dmp

    Filesize

    96KB

  • memory/360-109-0x0000000000890000-0x00000000008AA000-memory.dmp

    Filesize

    104KB

  • memory/360-108-0x00000000001D0000-0x00000000001FD000-memory.dmp

    Filesize

    180KB

  • memory/2028-157-0x0000000000B40000-0x0000000000B70000-memory.dmp

    Filesize

    192KB

  • memory/2028-158-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/2028-159-0x0000000004790000-0x00000000047D0000-memory.dmp

    Filesize

    256KB

  • memory/2028-160-0x0000000004790000-0x00000000047D0000-memory.dmp

    Filesize

    256KB