Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    105s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2023, 06:57

General

  • Target

    160c36e5d33c1320ff1cb8909dc8d760ba615223f4ac903b6254d6c854a089b5.exe

  • Size

    1.0MB

  • MD5

    44efdb18c708aeafb17978c6eff62efa

  • SHA1

    7f151397945a8b9031d0d7a2e593b08e71847aa5

  • SHA256

    160c36e5d33c1320ff1cb8909dc8d760ba615223f4ac903b6254d6c854a089b5

  • SHA512

    87193444e013f6c2f761199de8901bc657d5dbe91247614bf390eced33642d2ca56d62a000711a5f340cadaad4b87a7b7658345bb4f2745ae5fb59dbb5fbee07

  • SSDEEP

    24576:yy9wCUn1Xrrxcwua2YmjopWkWg6t6+Suh0:Z9wCUdrMNYmjoD6cih

Malware Config

Extracted

Family

redline

Botnet

diza

C2

185.161.248.37:4138

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 20 IoCs
  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\160c36e5d33c1320ff1cb8909dc8d760ba615223f4ac903b6254d6c854a089b5.exe
    "C:\Users\Admin\AppData\Local\Temp\160c36e5d33c1320ff1cb8909dc8d760ba615223f4ac903b6254d6c854a089b5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0952742.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0952742.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2148
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4666682.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4666682.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2024
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5749207.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5749207.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1896
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4137930.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4137930.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4584
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3224
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
          4⤵
          • Executes dropped EXE
          PID:4700
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
          4⤵
          • Executes dropped EXE
          PID:2508
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of UnmapMainImage
          PID:616
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 12
            5⤵
            • Program crash
            PID:2728
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7955426.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7955426.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3900
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 616 -ip 616
    1⤵
      PID:3360

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7955426.exe

      Filesize

      286KB

      MD5

      290f1ef585fef64520c409c1dce54e7d

      SHA1

      a66289d497773a28b7169631f8c557be69bd48ab

      SHA256

      a7f2f57ed12dae6f09696a0080e6e417b945ed98b0954bcc0d565f2cd759764d

      SHA512

      4b406faaebe548a1e6e45d5676617ef8b2a1756f04faac3e82f9fb67fa30669d4376dfd11e105c62f9db62dc13e7a5c630c459a303b950bd74eeec425c94cd92

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i7955426.exe

      Filesize

      286KB

      MD5

      290f1ef585fef64520c409c1dce54e7d

      SHA1

      a66289d497773a28b7169631f8c557be69bd48ab

      SHA256

      a7f2f57ed12dae6f09696a0080e6e417b945ed98b0954bcc0d565f2cd759764d

      SHA512

      4b406faaebe548a1e6e45d5676617ef8b2a1756f04faac3e82f9fb67fa30669d4376dfd11e105c62f9db62dc13e7a5c630c459a303b950bd74eeec425c94cd92

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0952742.exe

      Filesize

      751KB

      MD5

      7e469354675ba2c757280e4993bb0318

      SHA1

      be4c756756c13bc9f0c334aa197b17c9ee29fe70

      SHA256

      e819c0aad8ac1cd60aee625253662413cc9ac5c078010037c7e4c526db2c0a50

      SHA512

      d3755d76fa5782260b293993cd8e3e5935a792f6b3927fecea9379f00a83254bcc6511ed7b44617e64a31560c0ea9945bb90d59fd17c90028c6ab882332b4137

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0952742.exe

      Filesize

      751KB

      MD5

      7e469354675ba2c757280e4993bb0318

      SHA1

      be4c756756c13bc9f0c334aa197b17c9ee29fe70

      SHA256

      e819c0aad8ac1cd60aee625253662413cc9ac5c078010037c7e4c526db2c0a50

      SHA512

      d3755d76fa5782260b293993cd8e3e5935a792f6b3927fecea9379f00a83254bcc6511ed7b44617e64a31560c0ea9945bb90d59fd17c90028c6ab882332b4137

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe

      Filesize

      966KB

      MD5

      1012a9e9d9d7c5a799af770538729fa4

      SHA1

      5222d8212f8f109ba0d35b538c2eae8fd6e566d7

      SHA256

      c17c916b989dc10721aa95141a693e6f2e55c4b6a66912e759ece415b82fb63c

      SHA512

      158ff24434628e67223db9881861acdef4d9b31b1b37e418193740a0d6df9e4de0b7c4b57b8d421ff2d8c17b6922d25f149db12135281fd429181c0c1d74b615

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe

      Filesize

      966KB

      MD5

      1012a9e9d9d7c5a799af770538729fa4

      SHA1

      5222d8212f8f109ba0d35b538c2eae8fd6e566d7

      SHA256

      c17c916b989dc10721aa95141a693e6f2e55c4b6a66912e759ece415b82fb63c

      SHA512

      158ff24434628e67223db9881861acdef4d9b31b1b37e418193740a0d6df9e4de0b7c4b57b8d421ff2d8c17b6922d25f149db12135281fd429181c0c1d74b615

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe

      Filesize

      966KB

      MD5

      1012a9e9d9d7c5a799af770538729fa4

      SHA1

      5222d8212f8f109ba0d35b538c2eae8fd6e566d7

      SHA256

      c17c916b989dc10721aa95141a693e6f2e55c4b6a66912e759ece415b82fb63c

      SHA512

      158ff24434628e67223db9881861acdef4d9b31b1b37e418193740a0d6df9e4de0b7c4b57b8d421ff2d8c17b6922d25f149db12135281fd429181c0c1d74b615

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe

      Filesize

      966KB

      MD5

      1012a9e9d9d7c5a799af770538729fa4

      SHA1

      5222d8212f8f109ba0d35b538c2eae8fd6e566d7

      SHA256

      c17c916b989dc10721aa95141a693e6f2e55c4b6a66912e759ece415b82fb63c

      SHA512

      158ff24434628e67223db9881861acdef4d9b31b1b37e418193740a0d6df9e4de0b7c4b57b8d421ff2d8c17b6922d25f149db12135281fd429181c0c1d74b615

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7064546.exe

      Filesize

      966KB

      MD5

      1012a9e9d9d7c5a799af770538729fa4

      SHA1

      5222d8212f8f109ba0d35b538c2eae8fd6e566d7

      SHA256

      c17c916b989dc10721aa95141a693e6f2e55c4b6a66912e759ece415b82fb63c

      SHA512

      158ff24434628e67223db9881861acdef4d9b31b1b37e418193740a0d6df9e4de0b7c4b57b8d421ff2d8c17b6922d25f149db12135281fd429181c0c1d74b615

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4666682.exe

      Filesize

      306KB

      MD5

      0720140a98dad699f20a47d978ebd546

      SHA1

      2a0a1bbb457b22e052abadc1f1032a2bfdbd4672

      SHA256

      3601026b461e7270fc5fba7edeb349df7dc4f3e39abc8cc8535eb0b84c9c6344

      SHA512

      fb4598b56a5a63aba6b2038ffd67cbcc5fd77f14d3f16c761863d893cd53a13660be9e52b2840f5c9e3879ae6037ae1befa4896784e280a7182d6a1bd67dfdfa

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4666682.exe

      Filesize

      306KB

      MD5

      0720140a98dad699f20a47d978ebd546

      SHA1

      2a0a1bbb457b22e052abadc1f1032a2bfdbd4672

      SHA256

      3601026b461e7270fc5fba7edeb349df7dc4f3e39abc8cc8535eb0b84c9c6344

      SHA512

      fb4598b56a5a63aba6b2038ffd67cbcc5fd77f14d3f16c761863d893cd53a13660be9e52b2840f5c9e3879ae6037ae1befa4896784e280a7182d6a1bd67dfdfa

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5749207.exe

      Filesize

      146KB

      MD5

      d52841b6d1386577a98d1a521cdf99d0

      SHA1

      f2172aab5a368cb120838b2b7bac5e486ecfcb6f

      SHA256

      b55f667e95f2a65d72b2b314f493c17b193ce2c6dc48238460dd99ba967764a6

      SHA512

      58f03195df2d3edfecb491bc9bdaae817dff5f0433e0e0944676a333bc9f99f644326f16c8228a07f5410e927fd3a8e8a2fb08f7283806d33086c5deb861bf6a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f5749207.exe

      Filesize

      146KB

      MD5

      d52841b6d1386577a98d1a521cdf99d0

      SHA1

      f2172aab5a368cb120838b2b7bac5e486ecfcb6f

      SHA256

      b55f667e95f2a65d72b2b314f493c17b193ce2c6dc48238460dd99ba967764a6

      SHA512

      58f03195df2d3edfecb491bc9bdaae817dff5f0433e0e0944676a333bc9f99f644326f16c8228a07f5410e927fd3a8e8a2fb08f7283806d33086c5deb861bf6a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4137930.exe

      Filesize

      186KB

      MD5

      7bc917c948a152e0863f7af425263606

      SHA1

      b87759119fbe80eb31f009c5c38e3e345e11a758

      SHA256

      783a514be12d2d907f682a29e5144df0bbd1bac63ba175287cfa7bd6d22db568

      SHA512

      eb1deafae129ec8e83344bf751c101dd11b570e34deff15ea3b2720aaec09b6e83ea60818ef51a2463b87556e56417c150db9ee3f3fb5f7263ce01d06a19b1a4

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g4137930.exe

      Filesize

      186KB

      MD5

      7bc917c948a152e0863f7af425263606

      SHA1

      b87759119fbe80eb31f009c5c38e3e345e11a758

      SHA256

      783a514be12d2d907f682a29e5144df0bbd1bac63ba175287cfa7bd6d22db568

      SHA512

      eb1deafae129ec8e83344bf751c101dd11b570e34deff15ea3b2720aaec09b6e83ea60818ef51a2463b87556e56417c150db9ee3f3fb5f7263ce01d06a19b1a4

    • memory/616-214-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/1896-156-0x0000000004EA0000-0x0000000004FAA000-memory.dmp

      Filesize

      1.0MB

    • memory/1896-161-0x0000000006280000-0x0000000006824000-memory.dmp

      Filesize

      5.6MB

    • memory/1896-166-0x0000000006F30000-0x000000000745C000-memory.dmp

      Filesize

      5.2MB

    • memory/1896-167-0x00000000050F0000-0x0000000005100000-memory.dmp

      Filesize

      64KB

    • memory/1896-164-0x0000000005E10000-0x0000000005E60000-memory.dmp

      Filesize

      320KB

    • memory/1896-163-0x0000000005E90000-0x0000000005F06000-memory.dmp

      Filesize

      472KB

    • memory/1896-162-0x0000000005D70000-0x0000000005E02000-memory.dmp

      Filesize

      584KB

    • memory/1896-165-0x0000000006830000-0x00000000069F2000-memory.dmp

      Filesize

      1.8MB

    • memory/1896-160-0x0000000005170000-0x00000000051D6000-memory.dmp

      Filesize

      408KB

    • memory/1896-159-0x00000000050F0000-0x0000000005100000-memory.dmp

      Filesize

      64KB

    • memory/1896-158-0x0000000004E30000-0x0000000004E6C000-memory.dmp

      Filesize

      240KB

    • memory/1896-157-0x0000000004DD0000-0x0000000004DE2000-memory.dmp

      Filesize

      72KB

    • memory/1896-155-0x00000000053B0000-0x00000000059C8000-memory.dmp

      Filesize

      6.1MB

    • memory/1896-154-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/3224-210-0x0000000000B20000-0x0000000000C18000-memory.dmp

      Filesize

      992KB

    • memory/3224-211-0x0000000002E10000-0x0000000002E20000-memory.dmp

      Filesize

      64KB

    • memory/3900-227-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-242-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-1135-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-1134-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-1133-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-1131-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-256-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-254-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-252-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-250-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-248-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-246-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-244-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-240-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-238-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-236-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-233-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-234-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-231-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-229-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-230-0x0000000004A30000-0x0000000004A40000-memory.dmp

      Filesize

      64KB

    • memory/3900-221-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-223-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-220-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/3900-225-0x0000000004990000-0x00000000049CC000-memory.dmp

      Filesize

      240KB

    • memory/4584-188-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/4584-190-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-173-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-177-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-179-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-181-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-184-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/4584-185-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/4584-183-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-187-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-175-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-205-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/4584-172-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-204-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/4584-203-0x0000000004B60000-0x0000000004B70000-memory.dmp

      Filesize

      64KB

    • memory/4584-202-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-200-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-198-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-196-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-194-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB

    • memory/4584-192-0x0000000002500000-0x0000000002516000-memory.dmp

      Filesize

      88KB