Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    105s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/05/2023, 12:02

General

  • Target

    bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe

  • Size

    1.1MB

  • MD5

    b23203154afacedf05e93cf1e3abae42

  • SHA1

    c521a29f79cec20f1178c71ac846d071aa7313b8

  • SHA256

    bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827

  • SHA512

    8718a75ba665e2a01726cc89342bb464ffaf936dabf86e180f5b933a0e6dbfbecb1c6cc98298abb1e08c423017c8a320a29117b78eb17ccb7f282521e37ceee3

  • SSDEEP

    12288:3Mrhy90uDoRW0yuOWS03R99QQMBvjdn6B7E6Q2SCDJ0JFSjSYOjkoXFTyY+g2KLk:GymNvZ+RjdnISbJ5tR1Tylg2Kldvpa

Malware Config

Extracted

Family

redline

Botnet

demis

C2

185.161.248.25:4132

Attributes
  • auth_value

    8a9a54cb72dc3d7ab6792d3a28b3d1e1

Extracted

Family

redline

Botnet

naher

C2

185.161.248.25:4132

Attributes
  • auth_value

    91f06fcf80f600c56b2797e1c73d214d

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe
    "C:\Users\Admin\AppData\Local\Temp\bbcb08267aa426d56f20d9a3eff4674458763271ec75b939d4163f2b6a033827.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7200994.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7200994.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5359964.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5359964.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4488
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9886929.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9886929.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4060
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7307316.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7307316.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3284
          • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3156
            • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of UnmapMainImage
              PID:3380
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 12
                7⤵
                • Program crash
                PID:2008
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:716
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2308
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3380 -ip 3380
    1⤵
      PID:4832

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\n3287562.exe.log

      Filesize

      425B

      MD5

      4eaca4566b22b01cd3bc115b9b0b2196

      SHA1

      e743e0792c19f71740416e7b3c061d9f1336bf94

      SHA256

      34ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb

      SHA512

      bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe

      Filesize

      904KB

      MD5

      69cc8c9877787beb1664390c375f7456

      SHA1

      8d81dab4b096e8f00810441d823290142bea6ecd

      SHA256

      aa142a97547627f57120a5f4fa14ffa407892a94a818fa31a953426f3398594e

      SHA512

      ef889b3bf5684bf3ac061e23b61b358f8410e8586567443c3afc0bd52c4c2d7fb28ad7a967a195b0000efb20d25274bd8753ae7eb5aebcc7b9cfb965ef0537b6

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe

      Filesize

      904KB

      MD5

      69cc8c9877787beb1664390c375f7456

      SHA1

      8d81dab4b096e8f00810441d823290142bea6ecd

      SHA256

      aa142a97547627f57120a5f4fa14ffa407892a94a818fa31a953426f3398594e

      SHA512

      ef889b3bf5684bf3ac061e23b61b358f8410e8586567443c3afc0bd52c4c2d7fb28ad7a967a195b0000efb20d25274bd8753ae7eb5aebcc7b9cfb965ef0537b6

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n3287562.exe

      Filesize

      904KB

      MD5

      69cc8c9877787beb1664390c375f7456

      SHA1

      8d81dab4b096e8f00810441d823290142bea6ecd

      SHA256

      aa142a97547627f57120a5f4fa14ffa407892a94a818fa31a953426f3398594e

      SHA512

      ef889b3bf5684bf3ac061e23b61b358f8410e8586567443c3afc0bd52c4c2d7fb28ad7a967a195b0000efb20d25274bd8753ae7eb5aebcc7b9cfb965ef0537b6

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7200994.exe

      Filesize

      750KB

      MD5

      f30c42b499ce3dbe49a27f7c9bff07f3

      SHA1

      21e8959d7c41a25e2afb2c1e40989d3dd878f9a5

      SHA256

      4dfd4a0d556cdf045371a66e8749e3d10803dbadcbb9f4e28bc9ca6a86986161

      SHA512

      28c2a8ee4fdeb548ee225a33a9c025ef74db4e764bec9af38f8a4180de1b17834845b9482754ee40cff79735104f3feb7e1b7017131106678d63d7e23586f2d4

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7200994.exe

      Filesize

      750KB

      MD5

      f30c42b499ce3dbe49a27f7c9bff07f3

      SHA1

      21e8959d7c41a25e2afb2c1e40989d3dd878f9a5

      SHA256

      4dfd4a0d556cdf045371a66e8749e3d10803dbadcbb9f4e28bc9ca6a86986161

      SHA512

      28c2a8ee4fdeb548ee225a33a9c025ef74db4e764bec9af38f8a4180de1b17834845b9482754ee40cff79735104f3feb7e1b7017131106678d63d7e23586f2d4

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m7445108.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5359964.exe

      Filesize

      306KB

      MD5

      9a062271871c043089ef349c7b7c9120

      SHA1

      cb5f06549051f5cfa689bb0d4dbc03307872be28

      SHA256

      bfc086ad976de72ac457bf89b9e65dea6e19e0d64c33807d912537347bc2abc2

      SHA512

      9456705d84ce84a67a332f8f0e74c1adba82036c46a0dcbbe536c0793cdabf6e3f351657a78a28b3ffe430772f8cd3f8412c55d50fe72eb754fe25508934ee85

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5359964.exe

      Filesize

      306KB

      MD5

      9a062271871c043089ef349c7b7c9120

      SHA1

      cb5f06549051f5cfa689bb0d4dbc03307872be28

      SHA256

      bfc086ad976de72ac457bf89b9e65dea6e19e0d64c33807d912537347bc2abc2

      SHA512

      9456705d84ce84a67a332f8f0e74c1adba82036c46a0dcbbe536c0793cdabf6e3f351657a78a28b3ffe430772f8cd3f8412c55d50fe72eb754fe25508934ee85

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9886929.exe

      Filesize

      185KB

      MD5

      9389155bd175d89124038b97ebb26ab0

      SHA1

      069ef9bf389efd2b023a73f7bebbf0a86c32eacd

      SHA256

      bcc5468b8a2f29d3fe707f17c0bf93a6d60d94f72ade83df85c18de9cafe3498

      SHA512

      27dbbdcc3e4a85f99e375bd19336f20227a78a985e0b09c0152fce42b30aab4d16c90bedc476738145756bfb0ce91674e75bd31851fbd911cdceb8698488c60f

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k9886929.exe

      Filesize

      185KB

      MD5

      9389155bd175d89124038b97ebb26ab0

      SHA1

      069ef9bf389efd2b023a73f7bebbf0a86c32eacd

      SHA256

      bcc5468b8a2f29d3fe707f17c0bf93a6d60d94f72ade83df85c18de9cafe3498

      SHA512

      27dbbdcc3e4a85f99e375bd19336f20227a78a985e0b09c0152fce42b30aab4d16c90bedc476738145756bfb0ce91674e75bd31851fbd911cdceb8698488c60f

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7307316.exe

      Filesize

      145KB

      MD5

      470d3ad1256745024e705ea3c9f3c59b

      SHA1

      dd6bc2d3c5412e493cd160226f5a375110ba6e56

      SHA256

      be5d97e37edfced7c80754336516c3cebb85f76e0a908fe6853989a463d79501

      SHA512

      eb8e86cbb129d77d94716084acc7836a72e3475d2eaeceeb17a2ddd2008e73e872253360613ed7a7d93c9aa94dc978553fcd0a1faa9b8451452be06309572199

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7307316.exe

      Filesize

      145KB

      MD5

      470d3ad1256745024e705ea3c9f3c59b

      SHA1

      dd6bc2d3c5412e493cd160226f5a375110ba6e56

      SHA256

      be5d97e37edfced7c80754336516c3cebb85f76e0a908fe6853989a463d79501

      SHA512

      eb8e86cbb129d77d94716084acc7836a72e3475d2eaeceeb17a2ddd2008e73e872253360613ed7a7d93c9aa94dc978553fcd0a1faa9b8451452be06309572199

    • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

      Filesize

      963KB

      MD5

      7ea038cff79134b390d19c9c9c8f19f9

      SHA1

      aab0eee8edde660f08f304bbccd4020e9c463c17

      SHA256

      cfa0fe3f7be9cc69262ddfce2592cb1b534253d00e1d67291fbbdb57b5527954

      SHA512

      58f50c037da9b237f6b7777f8bc606bee60529a49ee2b73dac7f5e766438092fe8b89f1bf071e4287d18c6d77bb22487d403e50d32ce1322ec7a11d5183ffebb

    • memory/344-196-0x0000000005930000-0x0000000005940000-memory.dmp

      Filesize

      64KB

    • memory/344-195-0x0000000005940000-0x000000000597C000-memory.dmp

      Filesize

      240KB

    • memory/344-194-0x00000000058C0000-0x00000000058D2000-memory.dmp

      Filesize

      72KB

    • memory/344-201-0x0000000005930000-0x0000000005940000-memory.dmp

      Filesize

      64KB

    • memory/344-200-0x0000000007870000-0x0000000007D9C000-memory.dmp

      Filesize

      5.2MB

    • memory/344-202-0x0000000007340000-0x00000000073B6000-memory.dmp

      Filesize

      472KB

    • memory/344-203-0x00000000070F0000-0x0000000007140000-memory.dmp

      Filesize

      320KB

    • memory/344-199-0x0000000007170000-0x0000000007332000-memory.dmp

      Filesize

      1.8MB

    • memory/344-191-0x0000000000EF0000-0x0000000000F1A000-memory.dmp

      Filesize

      168KB

    • memory/344-198-0x0000000006440000-0x00000000064A6000-memory.dmp

      Filesize

      408KB

    • memory/344-197-0x0000000005C60000-0x0000000005CF2000-memory.dmp

      Filesize

      584KB

    • memory/344-193-0x0000000005990000-0x0000000005A9A000-memory.dmp

      Filesize

      1.0MB

    • memory/344-192-0x0000000005E20000-0x0000000006438000-memory.dmp

      Filesize

      6.1MB

    • memory/716-221-0x00000000078B0000-0x00000000078C0000-memory.dmp

      Filesize

      64KB

    • memory/716-220-0x0000000000990000-0x0000000000A78000-memory.dmp

      Filesize

      928KB

    • memory/1948-209-0x0000000007B90000-0x0000000007BA0000-memory.dmp

      Filesize

      64KB

    • memory/1948-208-0x0000000000CF0000-0x0000000000DE8000-memory.dmp

      Filesize

      992KB

    • memory/2308-241-0x0000000005B70000-0x0000000005B80000-memory.dmp

      Filesize

      64KB

    • memory/2308-237-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/3156-236-0x00000000075A0000-0x00000000075B0000-memory.dmp

      Filesize

      64KB

    • memory/3284-213-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/3284-210-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/3284-235-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/3284-218-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/3284-214-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/4060-170-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-166-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-176-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-180-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-174-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-182-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-172-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-186-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

    • memory/4060-168-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-178-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-164-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-162-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-184-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-160-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-158-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-157-0x0000000002650000-0x0000000002667000-memory.dmp

      Filesize

      92KB

    • memory/4060-155-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

    • memory/4060-156-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB

    • memory/4060-154-0x0000000004B00000-0x00000000050A4000-memory.dmp

      Filesize

      5.6MB

    • memory/4060-185-0x0000000002670000-0x0000000002680000-memory.dmp

      Filesize

      64KB