Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    105s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2023, 18:34

General

  • Target

    c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe

  • Size

    479KB

  • MD5

    1e332bf2f450ec03f8af4bf4d167ecc0

  • SHA1

    15d3f160079ff0287835743092449cc3bf73ad24

  • SHA256

    c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338

  • SHA512

    c7231d02677d01471a1b4ea4e1976f312483853132cfbe302c2b5c7ea6f96f7abb7b15e39569d373f20f1cf489de1e15ea6b668c5cc60e67ec0584b0b38cb8b7

  • SSDEEP

    12288:5MrWy90cALnqt8n+Qr5f/8oV97WvFV8Zx:Dy3hq+Qh/PY0

Malware Config

Extracted

Family

redline

Botnet

murka

C2

217.196.96.101:4132

Attributes
  • auth_value

    878a0681ac6ad0e4eb10ef9db07abdd9

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe
    "C:\Users\Admin\AppData\Local\Temp\c007d4218a8129e21fe8974fe25d1ad803753f1bfb492285a8c2238c0cce7338.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4118595.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4118595.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7239400.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7239400.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4404
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3647477.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3647477.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3348966.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3348966.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1876
      • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
        "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:220
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:4672
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c3912af058" /P "Admin:N"&&CACLS "..\c3912af058" /P "Admin:R" /E&&Exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4364
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /S /D /c" echo Y"
            5⤵
              PID:4956
            • C:\Windows\SysWOW64\cacls.exe
              CACLS "oneetx.exe" /P "Admin:N"
              5⤵
                PID:1456
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "oneetx.exe" /P "Admin:R" /E
                5⤵
                  PID:4996
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  5⤵
                    PID:5000
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\c3912af058" /P "Admin:N"
                    5⤵
                      PID:3904
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\c3912af058" /P "Admin:R" /E
                      5⤵
                        PID:4416
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                      4⤵
                      • Loads dropped DLL
                      PID:4868
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:2076
              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
                1⤵
                • Executes dropped EXE
                PID:5024

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3348966.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3348966.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4118595.exe

                Filesize

                307KB

                MD5

                1efa290b73fb39731bebaee08a850f1b

                SHA1

                6821b1fe18a46f9f1a1aa3035dbd8a86b767781f

                SHA256

                c039f39a928a977f885935a55f092d1b7067373c1271901bf2ef38a0836c16a2

                SHA512

                dd2a35be6135ce254272463c8c37d93c25c8e32dfd892f2215449748e3ed37d59cf4dcbc29f31039d44e1c1d3d5ff8b30a5584129f2e33b6900679ad11b9e0f4

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v4118595.exe

                Filesize

                307KB

                MD5

                1efa290b73fb39731bebaee08a850f1b

                SHA1

                6821b1fe18a46f9f1a1aa3035dbd8a86b767781f

                SHA256

                c039f39a928a977f885935a55f092d1b7067373c1271901bf2ef38a0836c16a2

                SHA512

                dd2a35be6135ce254272463c8c37d93c25c8e32dfd892f2215449748e3ed37d59cf4dcbc29f31039d44e1c1d3d5ff8b30a5584129f2e33b6900679ad11b9e0f4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7239400.exe

                Filesize

                181KB

                MD5

                ef8f4bef6490a940b23c702ed8bb53c2

                SHA1

                f04d31230b3d75bcff14ad9142963317cb3c7eed

                SHA256

                0e18b78490fb2362e37ece4ae7f5a6dcdea7742a0f7abb66352c08f63c7157a4

                SHA512

                a4378730b274b7b15db2a14c246bb5f64889540ed0611cab2a02be9ae473ea175798db1e19e4cfe05bbb89773dc659f681be8bc907e2d4ee89660142440bd15b

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a7239400.exe

                Filesize

                181KB

                MD5

                ef8f4bef6490a940b23c702ed8bb53c2

                SHA1

                f04d31230b3d75bcff14ad9142963317cb3c7eed

                SHA256

                0e18b78490fb2362e37ece4ae7f5a6dcdea7742a0f7abb66352c08f63c7157a4

                SHA512

                a4378730b274b7b15db2a14c246bb5f64889540ed0611cab2a02be9ae473ea175798db1e19e4cfe05bbb89773dc659f681be8bc907e2d4ee89660142440bd15b

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3647477.exe

                Filesize

                168KB

                MD5

                20ce3f79e6e81d7cce0fc80cf38ebe7b

                SHA1

                1a0f6a77a43cbaeaa7928ba9e3d4e4792a8c853e

                SHA256

                1d7365524aded881b100ef8b747254dcc83a1470bb22c61cf29a2b919051c48b

                SHA512

                3068ea11e21c6b528558de8ed1602e165a2e65209eee22cfec0cb96d3cced2b98c78e691e6c1e50c78de8114acd5a332ae6b720409dcb81ba7012a1ee0d088ab

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b3647477.exe

                Filesize

                168KB

                MD5

                20ce3f79e6e81d7cce0fc80cf38ebe7b

                SHA1

                1a0f6a77a43cbaeaa7928ba9e3d4e4792a8c853e

                SHA256

                1d7365524aded881b100ef8b747254dcc83a1470bb22c61cf29a2b919051c48b

                SHA512

                3068ea11e21c6b528558de8ed1602e165a2e65209eee22cfec0cb96d3cced2b98c78e691e6c1e50c78de8114acd5a332ae6b720409dcb81ba7012a1ee0d088ab

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

                Filesize

                211KB

                MD5

                eaaf8479a31099a0e38c1135ea543ca8

                SHA1

                3b3ad9dbca4148ee4371ccf9dc91e63e711c0c13

                SHA256

                fc40bcabd7190a9920c345bdbc97b1cd9fa367306d6e9c9956128ecb53f7df37

                SHA512

                5da3e89d11b0f8b32136dd3e058c3c5d07030b39a6a214f99c29109922e29e7f37f5e6d8831c42436a928a21ae2dfe2e7fd1857323808c7b9fc7bb29a61955d2

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                8451a2c5daa42b25333b1b2089c5ea39

                SHA1

                700cc99ec8d3113435e657070d2d6bde0a833adc

                SHA256

                b8c8aedd84c363853db934a55087a3b730cf9dc758dea3dc3a98f54217f4c9d0

                SHA512

                6d2bad0e6ec7852d7b6d1a70a10285db28c06c37252503e01c52458a463582d5211b7e183ae064a36b60f990971a5b14f8af3aaaacc4226be1c2e3e0bf38af53

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/1072-194-0x000000000CC20000-0x000000000D14C000-memory.dmp

                Filesize

                5.2MB

              • memory/1072-190-0x000000000B010000-0x000000000B086000-memory.dmp

                Filesize

                472KB

              • memory/1072-195-0x000000000C6F0000-0x000000000C740000-memory.dmp

                Filesize

                320KB

              • memory/1072-193-0x000000000C520000-0x000000000C6E2000-memory.dmp

                Filesize

                1.8MB

              • memory/1072-192-0x000000000B8F0000-0x000000000B956000-memory.dmp

                Filesize

                408KB

              • memory/1072-191-0x000000000B750000-0x000000000B7E2000-memory.dmp

                Filesize

                584KB

              • memory/1072-189-0x0000000005680000-0x0000000005690000-memory.dmp

                Filesize

                64KB

              • memory/1072-188-0x0000000005680000-0x0000000005690000-memory.dmp

                Filesize

                64KB

              • memory/1072-183-0x0000000000C80000-0x0000000000CB0000-memory.dmp

                Filesize

                192KB

              • memory/1072-184-0x000000000B130000-0x000000000B748000-memory.dmp

                Filesize

                6.1MB

              • memory/1072-185-0x000000000AC20000-0x000000000AD2A000-memory.dmp

                Filesize

                1.0MB

              • memory/1072-186-0x000000000AB30000-0x000000000AB42000-memory.dmp

                Filesize

                72KB

              • memory/1072-187-0x000000000AB90000-0x000000000ABCC000-memory.dmp

                Filesize

                240KB

              • memory/4404-165-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-161-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-173-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-163-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-177-0x00000000025F0000-0x0000000002600000-memory.dmp

                Filesize

                64KB

              • memory/4404-176-0x00000000025F0000-0x0000000002600000-memory.dmp

                Filesize

                64KB

              • memory/4404-167-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-175-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-171-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-169-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-178-0x00000000025F0000-0x0000000002600000-memory.dmp

                Filesize

                64KB

              • memory/4404-159-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-157-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-155-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-153-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-151-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-149-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-148-0x0000000002450000-0x0000000002462000-memory.dmp

                Filesize

                72KB

              • memory/4404-147-0x0000000004A80000-0x0000000005024000-memory.dmp

                Filesize

                5.6MB