Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/05/2023, 03:01

General

  • Target

    453bfed1bd93f009ed903b3163b3855f072756fafc209526f22ecd087b21e23b.exe

  • Size

    1.0MB

  • MD5

    1325a01757795ced1ea9b4911c30fc3c

  • SHA1

    6552547e908e0bcdc13cf73fdcd26b272b241dd7

  • SHA256

    453bfed1bd93f009ed903b3163b3855f072756fafc209526f22ecd087b21e23b

  • SHA512

    a5cf1828f16a392d8d330429bc730d8969901ad90d00cf06f9ca3ca11e6be5013aaf6df20912f9dd58b46f393978557ee40ae88110445a1647608259d5587e22

  • SSDEEP

    24576:xy4MobkXmlInvWnC4XJmKt4Ci3LMeJ+FtNHI2TrCtwQJ:k4MoqmovuHG3AeIBBTI

Malware Config

Extracted

Family

redline

Botnet

deren

C2

77.91.68.253:19065

Attributes
  • auth_value

    04a169f1fb198bfbeca74d0e06ea2d54

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 19 IoCs
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\453bfed1bd93f009ed903b3163b3855f072756fafc209526f22ecd087b21e23b.exe
    "C:\Users\Admin\AppData\Local\Temp\453bfed1bd93f009ed903b3163b3855f072756fafc209526f22ecd087b21e23b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9411273.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9411273.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2168
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6234044.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6234044.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1464
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0119679.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0119679.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2220
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6524203.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6524203.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:728
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of UnmapMainImage
          PID:3316
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3316 -s 12
            5⤵
            • Program crash
            PID:2656
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6862285.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6862285.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1456
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3316 -ip 3316
    1⤵
      PID:4692

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6862285.exe

      Filesize

      284KB

      MD5

      680cf46c6f0df6babba251ef495448ee

      SHA1

      eed0de68293c7607658d2aa048103624492022cb

      SHA256

      6842eced19aa0c474521d9e16f6524dba9fc8c13514b8d1f80a10eda17afbc80

      SHA512

      90f6a81800774c8bd27a5890db91bcc00d45ee040531653d385697599689f7fdfb564e97454184a8522cb204a19e2287022129d3f5bb26aa9b6fa00e0276f328

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i6862285.exe

      Filesize

      284KB

      MD5

      680cf46c6f0df6babba251ef495448ee

      SHA1

      eed0de68293c7607658d2aa048103624492022cb

      SHA256

      6842eced19aa0c474521d9e16f6524dba9fc8c13514b8d1f80a10eda17afbc80

      SHA512

      90f6a81800774c8bd27a5890db91bcc00d45ee040531653d385697599689f7fdfb564e97454184a8522cb204a19e2287022129d3f5bb26aa9b6fa00e0276f328

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9411273.exe

      Filesize

      750KB

      MD5

      728645a59479af80b716475d31d1c780

      SHA1

      10a1b5a3da3bb71516892710807c46b117881707

      SHA256

      b558040f1a386666c65fd84849fb3cd6ac0015569cf0b8c3b1183837a8de1cb6

      SHA512

      3897afda75da89d17cb56a9d1ba0cc2b48f731e38fc98708226da7022080d1f2ee266458e11339b8ae352d9a1a11f8e34d7a4d7af152d2df872d26ed8f9669cd

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9411273.exe

      Filesize

      750KB

      MD5

      728645a59479af80b716475d31d1c780

      SHA1

      10a1b5a3da3bb71516892710807c46b117881707

      SHA256

      b558040f1a386666c65fd84849fb3cd6ac0015569cf0b8c3b1183837a8de1cb6

      SHA512

      3897afda75da89d17cb56a9d1ba0cc2b48f731e38fc98708226da7022080d1f2ee266458e11339b8ae352d9a1a11f8e34d7a4d7af152d2df872d26ed8f9669cd

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe

      Filesize

      963KB

      MD5

      480b35415a84456dd46abba375d8d23d

      SHA1

      6f3e9b780b13441b8e112837cc3353ebdf71d548

      SHA256

      7c544d1ab874dda86ac6014f7c35b801b39c689c2e1abc80a36d31ac8c38fb0d

      SHA512

      4892fe5e67062efebd28e699b61a1335d030c699619e09c4feb93186482c49344839a9deb3836de0d1e43ff3e4e950091a7a892aaf253f01d08bd770743617bb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe

      Filesize

      963KB

      MD5

      480b35415a84456dd46abba375d8d23d

      SHA1

      6f3e9b780b13441b8e112837cc3353ebdf71d548

      SHA256

      7c544d1ab874dda86ac6014f7c35b801b39c689c2e1abc80a36d31ac8c38fb0d

      SHA512

      4892fe5e67062efebd28e699b61a1335d030c699619e09c4feb93186482c49344839a9deb3836de0d1e43ff3e4e950091a7a892aaf253f01d08bd770743617bb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h8937852.exe

      Filesize

      963KB

      MD5

      480b35415a84456dd46abba375d8d23d

      SHA1

      6f3e9b780b13441b8e112837cc3353ebdf71d548

      SHA256

      7c544d1ab874dda86ac6014f7c35b801b39c689c2e1abc80a36d31ac8c38fb0d

      SHA512

      4892fe5e67062efebd28e699b61a1335d030c699619e09c4feb93186482c49344839a9deb3836de0d1e43ff3e4e950091a7a892aaf253f01d08bd770743617bb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6234044.exe

      Filesize

      306KB

      MD5

      3d726bdcfc849389e430394155dd32f0

      SHA1

      4f9568ffb2f412663420ecd855e7efde74fa8da4

      SHA256

      323ef3300155de5a335d1ab37881d7d25e7a697026a3f3cd8fc46fcd0fdeef2a

      SHA512

      e053779bc65b7da727c6a676aa8410a47de6b3c2d08d8430ed00dc2258cd5569f3717bd7729eccacada4ba7f2de0cc4f5ff98dcfaf5c9a98a07e20e6937715f5

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x6234044.exe

      Filesize

      306KB

      MD5

      3d726bdcfc849389e430394155dd32f0

      SHA1

      4f9568ffb2f412663420ecd855e7efde74fa8da4

      SHA256

      323ef3300155de5a335d1ab37881d7d25e7a697026a3f3cd8fc46fcd0fdeef2a

      SHA512

      e053779bc65b7da727c6a676aa8410a47de6b3c2d08d8430ed00dc2258cd5569f3717bd7729eccacada4ba7f2de0cc4f5ff98dcfaf5c9a98a07e20e6937715f5

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0119679.exe

      Filesize

      145KB

      MD5

      bc73379bfcc3fb069de2ded9f99f8ef8

      SHA1

      2d14b3926dcb060903468ad6a72d46878c5f096a

      SHA256

      594e2e0baddf0ed85f99a64672c85a76fc039be9030e56961c89e148d15c4df8

      SHA512

      8b0e02c484ee565ad3135963012fd9cc7f87e0de0636436a91a892e1629d6377c12dc5a3cda6483dbf615dd1465a70e45587e7f44c1815a2ebf30dffd6db4d46

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f0119679.exe

      Filesize

      145KB

      MD5

      bc73379bfcc3fb069de2ded9f99f8ef8

      SHA1

      2d14b3926dcb060903468ad6a72d46878c5f096a

      SHA256

      594e2e0baddf0ed85f99a64672c85a76fc039be9030e56961c89e148d15c4df8

      SHA512

      8b0e02c484ee565ad3135963012fd9cc7f87e0de0636436a91a892e1629d6377c12dc5a3cda6483dbf615dd1465a70e45587e7f44c1815a2ebf30dffd6db4d46

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6524203.exe

      Filesize

      184KB

      MD5

      951b41b2029474742b093f4723f7313d

      SHA1

      c2fd6ec522cab71e9ab691c08ee950686fd0969f

      SHA256

      f75fc487d09f98567f6fe090e310f4d6933e6d70ab4ff9bef731a226b808edb3

      SHA512

      c942bee3b990a2c72c067990de6b863590c30f44241813ee876ef05d4b788eddaa0b99d072e893828a5522e8d7e37f0134795902bc07588903a006ddaff3dd8a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g6524203.exe

      Filesize

      184KB

      MD5

      951b41b2029474742b093f4723f7313d

      SHA1

      c2fd6ec522cab71e9ab691c08ee950686fd0969f

      SHA256

      f75fc487d09f98567f6fe090e310f4d6933e6d70ab4ff9bef731a226b808edb3

      SHA512

      c942bee3b990a2c72c067990de6b863590c30f44241813ee876ef05d4b788eddaa0b99d072e893828a5522e8d7e37f0134795902bc07588903a006ddaff3dd8a

    • memory/728-189-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-173-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-199-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-197-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-195-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-193-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-191-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-202-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

      Filesize

      64KB

    • memory/728-200-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

      Filesize

      64KB

    • memory/728-201-0x0000000004AD0000-0x0000000004AE0000-memory.dmp

      Filesize

      64KB

    • memory/728-172-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-175-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-177-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-179-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-181-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-183-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-185-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/728-187-0x0000000004960000-0x0000000004976000-memory.dmp

      Filesize

      88KB

    • memory/1456-226-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-242-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-1129-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/1456-1128-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/1456-1126-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/1456-323-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/1456-320-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/1456-319-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/1456-248-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-246-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-244-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-240-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-238-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-234-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-236-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-232-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-230-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-215-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-216-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-218-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-220-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-222-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-224-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/1456-228-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/2220-162-0x0000000006E10000-0x00000000073B4000-memory.dmp

      Filesize

      5.6MB

    • memory/2220-163-0x0000000006860000-0x00000000068D6000-memory.dmp

      Filesize

      472KB

    • memory/2220-156-0x00000000058F0000-0x00000000059FA000-memory.dmp

      Filesize

      1.0MB

    • memory/2220-157-0x0000000005820000-0x0000000005832000-memory.dmp

      Filesize

      72KB

    • memory/2220-166-0x00000000078F0000-0x0000000007E1C000-memory.dmp

      Filesize

      5.2MB

    • memory/2220-165-0x0000000006BD0000-0x0000000006D92000-memory.dmp

      Filesize

      1.8MB

    • memory/2220-164-0x0000000006770000-0x00000000067C0000-memory.dmp

      Filesize

      320KB

    • memory/2220-167-0x0000000005B40000-0x0000000005B50000-memory.dmp

      Filesize

      64KB

    • memory/2220-155-0x0000000005E00000-0x0000000006418000-memory.dmp

      Filesize

      6.1MB

    • memory/2220-159-0x0000000005B40000-0x0000000005B50000-memory.dmp

      Filesize

      64KB

    • memory/2220-158-0x0000000005880000-0x00000000058BC000-memory.dmp

      Filesize

      240KB

    • memory/2220-161-0x00000000067C0000-0x0000000006852000-memory.dmp

      Filesize

      584KB

    • memory/2220-154-0x0000000000E50000-0x0000000000E7A000-memory.dmp

      Filesize

      168KB

    • memory/2220-160-0x0000000005BC0000-0x0000000005C26000-memory.dmp

      Filesize

      408KB

    • memory/2876-207-0x0000000000B50000-0x0000000000C48000-memory.dmp

      Filesize

      992KB

    • memory/2876-208-0x00000000079D0000-0x00000000079E0000-memory.dmp

      Filesize

      64KB

    • memory/3316-209-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB