Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    61s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/05/2023, 11:57

General

  • Target

    ab2a976e6dbb7ac7a870b643a6cd30f4ce38e4bf175a4be25f3da2acbc632388.exe

  • Size

    1.0MB

  • MD5

    43ecad9168b97028b03c445e2bd3013c

  • SHA1

    8d974f38c618ef67b6f2120d514de53307cd3856

  • SHA256

    ab2a976e6dbb7ac7a870b643a6cd30f4ce38e4bf175a4be25f3da2acbc632388

  • SHA512

    6890a8e4d7090e2ed6de3269e51bf27d9a367f71e79e899ec8f7f27db0fbded5461fd4e1f80aacee99c0acf32f7638a8369e0a5e47ce9e97b0ff6bdf16f4cca4

  • SSDEEP

    24576:eyZbthJmJyW/M3YFWXw5XEDbFtTB/amUCKcOH:t5tbuyeM3mWg5XEDptlakO

Malware Config

Extracted

Family

redline

Botnet

duper

C2

77.91.68.253:19065

Attributes
  • auth_value

    57e17ebbdb18f4882b95fe05402ef1c8

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab2a976e6dbb7ac7a870b643a6cd30f4ce38e4bf175a4be25f3da2acbc632388.exe
    "C:\Users\Admin\AppData\Local\Temp\ab2a976e6dbb7ac7a870b643a6cd30f4ce38e4bf175a4be25f3da2acbc632388.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1363267.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1363267.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2940
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8409918.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8409918.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4504
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4956795.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4956795.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1884
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3486910.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3486910.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2708
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of UnmapMainImage
          PID:1308
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 12
            5⤵
            • Program crash
            PID:4056
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5859375.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5859375.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3496
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1308 -ip 1308
    1⤵
      PID:4616

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5859375.exe

      Filesize

      284KB

      MD5

      42d51312218efa1724707c205a694656

      SHA1

      6df1e68f9a8084b235ebdf6c44ee08f20ccaf3ce

      SHA256

      42f165677c203510161cbfd6aaeb765f93dcbc62da4bb4f57a03401ff240bf79

      SHA512

      8979279e92e4ce93e938a7e7212a9a62156a10148b34b4dc921d02c65f511e395a612902dd982c5c47f56d5e2275f95da71caf62225e09c436b5554110c7e5c8

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n5859375.exe

      Filesize

      284KB

      MD5

      42d51312218efa1724707c205a694656

      SHA1

      6df1e68f9a8084b235ebdf6c44ee08f20ccaf3ce

      SHA256

      42f165677c203510161cbfd6aaeb765f93dcbc62da4bb4f57a03401ff240bf79

      SHA512

      8979279e92e4ce93e938a7e7212a9a62156a10148b34b4dc921d02c65f511e395a612902dd982c5c47f56d5e2275f95da71caf62225e09c436b5554110c7e5c8

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1363267.exe

      Filesize

      749KB

      MD5

      4327e27ff749627a7a77fa8996eccf04

      SHA1

      6651dfe0f689d9a7aa345bdf33a1ef83ab03a33b

      SHA256

      997c92d031ad6c9c3471400fb633156b9dcc85fc06c6b313f6414ae778d13319

      SHA512

      780794b3981bb0e47c2c846788d4180171fe8593700a5d22f07686e7a77ec6142942d4773edc51f2a67a6aeece11b52442bad9a850e2d4475fc9fbcb5697650c

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1363267.exe

      Filesize

      749KB

      MD5

      4327e27ff749627a7a77fa8996eccf04

      SHA1

      6651dfe0f689d9a7aa345bdf33a1ef83ab03a33b

      SHA256

      997c92d031ad6c9c3471400fb633156b9dcc85fc06c6b313f6414ae778d13319

      SHA512

      780794b3981bb0e47c2c846788d4180171fe8593700a5d22f07686e7a77ec6142942d4773edc51f2a67a6aeece11b52442bad9a850e2d4475fc9fbcb5697650c

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe

      Filesize

      963KB

      MD5

      6558a0af4ec83d583e47352a1abd6d82

      SHA1

      38389ee51287380b6cf69c934b5d00104d597ea0

      SHA256

      9b1dc9c732314dbc992b24518cced88dd68498bc85a66340ce46ceea34bc7df1

      SHA512

      9556664694317d3a813f117ccdc812582b3b9e3c97056824945a1d918d327694464a7c54c634e762b4f57871892d051ad01bc22681f59446c11e2ae07fad4ea0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe

      Filesize

      963KB

      MD5

      6558a0af4ec83d583e47352a1abd6d82

      SHA1

      38389ee51287380b6cf69c934b5d00104d597ea0

      SHA256

      9b1dc9c732314dbc992b24518cced88dd68498bc85a66340ce46ceea34bc7df1

      SHA512

      9556664694317d3a813f117ccdc812582b3b9e3c97056824945a1d918d327694464a7c54c634e762b4f57871892d051ad01bc22681f59446c11e2ae07fad4ea0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0376972.exe

      Filesize

      963KB

      MD5

      6558a0af4ec83d583e47352a1abd6d82

      SHA1

      38389ee51287380b6cf69c934b5d00104d597ea0

      SHA256

      9b1dc9c732314dbc992b24518cced88dd68498bc85a66340ce46ceea34bc7df1

      SHA512

      9556664694317d3a813f117ccdc812582b3b9e3c97056824945a1d918d327694464a7c54c634e762b4f57871892d051ad01bc22681f59446c11e2ae07fad4ea0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8409918.exe

      Filesize

      305KB

      MD5

      4bf1a1a76317aa843faa7efbe7cad460

      SHA1

      c2ade6f88ad59774c4ef7729a74b3580b513597b

      SHA256

      5bbab81c14b4e29b575415ae3fa9841a3d34f032cd83c3b912dcf2c36efeee55

      SHA512

      5bcd0830b1524fd38ac05a33ff44dd270aa5350683410bf8186595de53d33c0c85b781d4dfbbf84bffa811277e0f0969657beda97179e65942617767b5cf324f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8409918.exe

      Filesize

      305KB

      MD5

      4bf1a1a76317aa843faa7efbe7cad460

      SHA1

      c2ade6f88ad59774c4ef7729a74b3580b513597b

      SHA256

      5bbab81c14b4e29b575415ae3fa9841a3d34f032cd83c3b912dcf2c36efeee55

      SHA512

      5bcd0830b1524fd38ac05a33ff44dd270aa5350683410bf8186595de53d33c0c85b781d4dfbbf84bffa811277e0f0969657beda97179e65942617767b5cf324f

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4956795.exe

      Filesize

      184KB

      MD5

      8d2aa71f829681b93608a06a621ed218

      SHA1

      052007fc6ed3afed207fca670978febfc556947e

      SHA256

      53dbe23aa1f86e9174c2523de7200fc9746d146792db818e201430ff575367fb

      SHA512

      35dea5300d0ebc7c59fa83d7b5cc91c54d426867a7319d96d242940a5c1bd847285274a357881c10cb13139ee436141cc005822a983a815e6fc50838d9572f27

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k4956795.exe

      Filesize

      184KB

      MD5

      8d2aa71f829681b93608a06a621ed218

      SHA1

      052007fc6ed3afed207fca670978febfc556947e

      SHA256

      53dbe23aa1f86e9174c2523de7200fc9746d146792db818e201430ff575367fb

      SHA512

      35dea5300d0ebc7c59fa83d7b5cc91c54d426867a7319d96d242940a5c1bd847285274a357881c10cb13139ee436141cc005822a983a815e6fc50838d9572f27

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3486910.exe

      Filesize

      145KB

      MD5

      eed36f44fe2b2c5f573cd39611c156aa

      SHA1

      c558fed3c702d77aea75f59a63fc684536d0c9a3

      SHA256

      52c9dee6bc1574f4f5b46e958b08eab6443e3568c02e446236fde0280d5e17d3

      SHA512

      c39499a448f072f9ae9b1e452b799602346853fe9f0a693142780020f9cc6eaaec98cfd7b67a2f6642c7dce9fe6c94d4fe32c79495664873275df5a67fb61a4d

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l3486910.exe

      Filesize

      145KB

      MD5

      eed36f44fe2b2c5f573cd39611c156aa

      SHA1

      c558fed3c702d77aea75f59a63fc684536d0c9a3

      SHA256

      52c9dee6bc1574f4f5b46e958b08eab6443e3568c02e446236fde0280d5e17d3

      SHA512

      c39499a448f072f9ae9b1e452b799602346853fe9f0a693142780020f9cc6eaaec98cfd7b67a2f6642c7dce9fe6c94d4fe32c79495664873275df5a67fb61a4d

    • memory/948-211-0x0000000007550000-0x0000000007560000-memory.dmp

      Filesize

      64KB

    • memory/948-210-0x00000000006C0000-0x00000000007B8000-memory.dmp

      Filesize

      992KB

    • memory/1308-212-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1884-166-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/1884-181-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-162-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-168-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-169-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/1884-167-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/1884-171-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-173-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-175-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-177-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-179-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-164-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-183-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-185-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-186-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/1884-187-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/1884-188-0x00000000024A0000-0x00000000024B0000-memory.dmp

      Filesize

      64KB

    • memory/1884-160-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-156-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-158-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-155-0x00000000024C0000-0x00000000024D6000-memory.dmp

      Filesize

      88KB

    • memory/1884-154-0x0000000004AD0000-0x0000000005074000-memory.dmp

      Filesize

      5.6MB

    • memory/2708-198-0x0000000005750000-0x0000000005760000-memory.dmp

      Filesize

      64KB

    • memory/2708-199-0x0000000005FB0000-0x0000000006042000-memory.dmp

      Filesize

      584KB

    • memory/2708-200-0x0000000005910000-0x0000000005976000-memory.dmp

      Filesize

      408KB

    • memory/2708-201-0x0000000006B10000-0x0000000006B86000-memory.dmp

      Filesize

      472KB

    • memory/2708-202-0x0000000006B90000-0x0000000006BE0000-memory.dmp

      Filesize

      320KB

    • memory/2708-197-0x0000000005490000-0x00000000054CC000-memory.dmp

      Filesize

      240KB

    • memory/2708-196-0x0000000005430000-0x0000000005442000-memory.dmp

      Filesize

      72KB

    • memory/2708-195-0x0000000005500000-0x000000000560A000-memory.dmp

      Filesize

      1.0MB

    • memory/2708-194-0x0000000005990000-0x0000000005FA8000-memory.dmp

      Filesize

      6.1MB

    • memory/2708-193-0x0000000000A60000-0x0000000000A8A000-memory.dmp

      Filesize

      168KB

    • memory/2708-203-0x0000000006DB0000-0x0000000006F72000-memory.dmp

      Filesize

      1.8MB

    • memory/2708-204-0x00000000074B0000-0x00000000079DC000-memory.dmp

      Filesize

      5.2MB

    • memory/2708-205-0x0000000005750000-0x0000000005760000-memory.dmp

      Filesize

      64KB

    • memory/3496-218-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-219-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-221-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-223-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-225-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-227-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-229-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-231-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-233-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-235-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-237-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-239-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-242-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB

    • memory/3496-245-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB

    • memory/3496-246-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-243-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB

    • memory/3496-248-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-241-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-250-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-252-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-254-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3496-1129-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB

    • memory/3496-1131-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB

    • memory/3496-1132-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB

    • memory/3496-1133-0x0000000004A60000-0x0000000004A70000-memory.dmp

      Filesize

      64KB