Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    145s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/05/2023, 13:58

General

  • Target

    d37283c260e1feb6161d27c8340baf3cdfccdb22fa97ce6a2c4906ea7dc38581.exe

  • Size

    479KB

  • MD5

    88dd337dc084e981a874fa1124518006

  • SHA1

    787e687b3f3128b76a04156073485d13a85ef82c

  • SHA256

    d37283c260e1feb6161d27c8340baf3cdfccdb22fa97ce6a2c4906ea7dc38581

  • SHA512

    16b4d76f9bb52cb30e84c600859a61e0d9f1d5daa0f8a293e4b0e3591b3868317d8d26ec8a3e70ac30cee63dca48f543601df165559456fa5f763b1f3e8b0732

  • SSDEEP

    12288:sMray90MRlzJRJaM713eGi8+rUjdQN2QkfXbsK:2yDrr3713iXr8Q0fLsK

Malware Config

Extracted

Family

redline

Botnet

douma

C2

217.196.96.101:4132

Attributes
  • auth_value

    e7c0659b5f9d26f2f97df8d25fefbb44

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d37283c260e1feb6161d27c8340baf3cdfccdb22fa97ce6a2c4906ea7dc38581.exe
    "C:\Users\Admin\AppData\Local\Temp\d37283c260e1feb6161d27c8340baf3cdfccdb22fa97ce6a2c4906ea7dc38581.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:404
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8452868.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8452868.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1156
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5373731.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5373731.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1304
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7860492.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7860492.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0507972.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0507972.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1480
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3796
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4900
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4912
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:2676
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:2764
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:3744
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:440
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:600
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:3920
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:4792
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:756
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:3708

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0507972.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i0507972.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8452868.exe

                Filesize

                307KB

                MD5

                673aee62691ea721d710f4aa440c4af8

                SHA1

                ac72a9d9df847283d15b9d82bd7d0d47d4715f1b

                SHA256

                8ab397d2f55a63d95587af5ddd1b23da8a819e2d9912b6772c7b0648882aa465

                SHA512

                46946a6f48c2ad36c2bbc99c7847011b0c8fee7cd5e41d9cec4a8f59249461a5d89045096d8b97ea7f901fbcb910094fb6b6595c627a23fc7e3c38f31d58b01b

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8452868.exe

                Filesize

                307KB

                MD5

                673aee62691ea721d710f4aa440c4af8

                SHA1

                ac72a9d9df847283d15b9d82bd7d0d47d4715f1b

                SHA256

                8ab397d2f55a63d95587af5ddd1b23da8a819e2d9912b6772c7b0648882aa465

                SHA512

                46946a6f48c2ad36c2bbc99c7847011b0c8fee7cd5e41d9cec4a8f59249461a5d89045096d8b97ea7f901fbcb910094fb6b6595c627a23fc7e3c38f31d58b01b

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5373731.exe

                Filesize

                168KB

                MD5

                774b2f7808ae60895d424cce8bcfc0bc

                SHA1

                0e28d3189fb436a94bd702b260ab7b305cf53713

                SHA256

                d4b2243dc37599cd9a1d289005612d7bfeb5f9c4aa6388077723f11d23edcaf2

                SHA512

                a6fd72fdae96e39e7c6622f33e035e7ce7dd7a0ec000e76070ad3b961b803b37f0cbe33e10162eee68b7f8b6a8d10b9a14546f0267d518c0f07414500830e612

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g5373731.exe

                Filesize

                168KB

                MD5

                774b2f7808ae60895d424cce8bcfc0bc

                SHA1

                0e28d3189fb436a94bd702b260ab7b305cf53713

                SHA256

                d4b2243dc37599cd9a1d289005612d7bfeb5f9c4aa6388077723f11d23edcaf2

                SHA512

                a6fd72fdae96e39e7c6622f33e035e7ce7dd7a0ec000e76070ad3b961b803b37f0cbe33e10162eee68b7f8b6a8d10b9a14546f0267d518c0f07414500830e612

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7860492.exe

                Filesize

                181KB

                MD5

                f6af5acd7bd84637b71cb9d5dbbb4aca

                SHA1

                5b8fd3a719c491a0c832a34b9d353647fa5f66da

                SHA256

                64587f876e856b8d28c55564da7302be7c9a26e1566bf8dd4568d0b3cd19d128

                SHA512

                8f6eff73a5069d8ee8485e77d4e79f3ee797dcbcb60a3135bcc96c02a5d0d430f0026699602cfe40fb4d3c57bb0f92e363bcec91957606a022d594b35ab710b7

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7860492.exe

                Filesize

                181KB

                MD5

                f6af5acd7bd84637b71cb9d5dbbb4aca

                SHA1

                5b8fd3a719c491a0c832a34b9d353647fa5f66da

                SHA256

                64587f876e856b8d28c55564da7302be7c9a26e1566bf8dd4568d0b3cd19d128

                SHA512

                8f6eff73a5069d8ee8485e77d4e79f3ee797dcbcb60a3135bcc96c02a5d0d430f0026699602cfe40fb4d3c57bb0f92e363bcec91957606a022d594b35ab710b7

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                88d0996165999d9441d3ad3a2536d5c7

                SHA1

                92b1f88f1a9c07f55f347ac258d63af7f2ae74a2

                SHA256

                e8afa60741084fbc8c3b2110e538ab079ece761ef073ea8ed1715f0a4e02fbe6

                SHA512

                98bcac8981762a8bcae97503554eb10700d32898a0b01c5bc78f8938c4bed60079183079b9b9352290ef9c32cdc4e33fc205fb0bc243c4e06c0214bbd9976276

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • memory/1304-142-0x0000000005930000-0x000000000597B000-memory.dmp

                Filesize

                300KB

              • memory/1304-144-0x0000000005BD0000-0x0000000005C62000-memory.dmp

                Filesize

                584KB

              • memory/1304-145-0x0000000005B30000-0x0000000005B96000-memory.dmp

                Filesize

                408KB

              • memory/1304-146-0x0000000006E40000-0x000000000733E000-memory.dmp

                Filesize

                5.0MB

              • memory/1304-147-0x0000000007340000-0x0000000007502000-memory.dmp

                Filesize

                1.8MB

              • memory/1304-148-0x0000000008FC0000-0x00000000094EC000-memory.dmp

                Filesize

                5.2MB

              • memory/1304-149-0x00000000055C0000-0x00000000055D0000-memory.dmp

                Filesize

                64KB

              • memory/1304-150-0x0000000006B60000-0x0000000006BB0000-memory.dmp

                Filesize

                320KB

              • memory/1304-143-0x0000000005AB0000-0x0000000005B26000-memory.dmp

                Filesize

                472KB

              • memory/1304-141-0x00000000055C0000-0x00000000055D0000-memory.dmp

                Filesize

                64KB

              • memory/1304-140-0x0000000005790000-0x00000000057CE000-memory.dmp

                Filesize

                248KB

              • memory/1304-139-0x0000000005730000-0x0000000005742000-memory.dmp

                Filesize

                72KB

              • memory/1304-138-0x0000000005820000-0x000000000592A000-memory.dmp

                Filesize

                1.0MB

              • memory/1304-137-0x0000000005D20000-0x0000000006326000-memory.dmp

                Filesize

                6.0MB

              • memory/1304-136-0x0000000001600000-0x0000000001606000-memory.dmp

                Filesize

                24KB

              • memory/1304-135-0x0000000000E20000-0x0000000000E4E000-memory.dmp

                Filesize

                184KB

              • memory/1728-156-0x0000000004910000-0x0000000004928000-memory.dmp

                Filesize

                96KB

              • memory/1728-170-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-172-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-174-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-176-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-178-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-180-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-182-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-184-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-168-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-166-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-164-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-162-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-160-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-158-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-157-0x0000000004910000-0x0000000004922000-memory.dmp

                Filesize

                72KB

              • memory/1728-155-0x00000000020D0000-0x00000000020EA000-memory.dmp

                Filesize

                104KB

              • memory/1728-185-0x00000000049B0000-0x00000000049C0000-memory.dmp

                Filesize

                64KB

              • memory/1728-186-0x00000000049B0000-0x00000000049C0000-memory.dmp

                Filesize

                64KB

              • memory/1728-187-0x00000000049B0000-0x00000000049C0000-memory.dmp

                Filesize

                64KB