Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2023, 10:29

General

  • Target

    d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe

  • Size

    872KB

  • MD5

    c49efa26968f3fd42e137fc67165627e

  • SHA1

    20f9a5cdc2a18b3f8547a96529e46a458e3e0596

  • SHA256

    d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b

  • SHA512

    6583197391fe879a311d0f31d967c3b29362fc7a236ab42b67d58d542405d454e6173fa67681fa99d7dbafe303cfc3c9b4dcba6b9f47f95566371b39a30b3ca7

  • SSDEEP

    12288:AMrwy900EgqYwKha9isr3ueSVeovoitevqkBImOu3YpnmMUo02GnQK09:AynEiNh6Zr3PioqBmOu3qbcQb9

Malware Config

Extracted

Family

redline

Botnet

maxi

C2

83.97.73.122:19062

Attributes
  • auth_value

    6a3f22e5f4209b056a3fd330dc71956a

Extracted

Family

redline

Botnet

mesu

C2

83.97.73.122:19062

Attributes
  • auth_value

    8ede6a157d1d9509a21427d10e999ba2

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe
    "C:\Users\Admin\AppData\Local\Temp\d065c20a1762bcac4c1a4ecc5416c262fe98c59cd5e35009260712f99af9336b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9573103.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9573103.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1705726.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1705726.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1192
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3352897.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3352897.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:644
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4328
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1070128.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1070128.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4756
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3454719.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3454719.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
          4⤵
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3112
          • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe"
            5⤵
            • Executes dropped EXE
            PID:1140
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3994649.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3994649.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2956
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1872

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3994649.exe

    Filesize

    328KB

    MD5

    151c24359e1de2213f0c21580fc2cc82

    SHA1

    212549f0f5b8897e182be80972f506fc684ed7d2

    SHA256

    a611bc889867cc2cea2c9816cf85f320efa4057b2853b8cfc8e22c4bf0d80b09

    SHA512

    834850b422424fc5924c90590ce9e38a561c4ce0e6b7df9b3ef46ba1bf643e5c56db799c27dd27d4f8d10da4d9bafced3d46093e39205e411e7a8618e7b1b3b0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3994649.exe

    Filesize

    328KB

    MD5

    151c24359e1de2213f0c21580fc2cc82

    SHA1

    212549f0f5b8897e182be80972f506fc684ed7d2

    SHA256

    a611bc889867cc2cea2c9816cf85f320efa4057b2853b8cfc8e22c4bf0d80b09

    SHA512

    834850b422424fc5924c90590ce9e38a561c4ce0e6b7df9b3ef46ba1bf643e5c56db799c27dd27d4f8d10da4d9bafced3d46093e39205e411e7a8618e7b1b3b0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9573103.exe

    Filesize

    601KB

    MD5

    4417e2376479cc5d966c88946edaa8df

    SHA1

    83b5d9fd1a2b3615466b543a4a20ae03bd22fe2a

    SHA256

    00905fc8a380eee4d80e0a6e073f4097641f4d3f243de17c7f8cd3c5a2159508

    SHA512

    e55d43810528daefe555287d7cfe747ebb37010a68e17ac4007325a1b02d7d16bcf1d105b55068ecc62523827473b60238f730f1acf394276267ef3dd00ee0fc

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9573103.exe

    Filesize

    601KB

    MD5

    4417e2376479cc5d966c88946edaa8df

    SHA1

    83b5d9fd1a2b3615466b543a4a20ae03bd22fe2a

    SHA256

    00905fc8a380eee4d80e0a6e073f4097641f4d3f243de17c7f8cd3c5a2159508

    SHA512

    e55d43810528daefe555287d7cfe747ebb37010a68e17ac4007325a1b02d7d16bcf1d105b55068ecc62523827473b60238f730f1acf394276267ef3dd00ee0fc

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3454719.exe

    Filesize

    387KB

    MD5

    f2ee764aa6b9542c8676fcc91de2cd30

    SHA1

    f20298bf57dfcf25ec757384335eae2bd4d990ba

    SHA256

    3e8dcbba9df94690fb8a9e50538a665a5bb3e2ad9886fc4ab91d4cd3eb5ca038

    SHA512

    8381578e5c01a4fd408a541a51672530744d28c709c63eddb9b694782f7e3aff2f6003bb442600d1d3e00be207660cc2820aec8d68dbb0f4ccfb5e096f912432

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c3454719.exe

    Filesize

    387KB

    MD5

    f2ee764aa6b9542c8676fcc91de2cd30

    SHA1

    f20298bf57dfcf25ec757384335eae2bd4d990ba

    SHA256

    3e8dcbba9df94690fb8a9e50538a665a5bb3e2ad9886fc4ab91d4cd3eb5ca038

    SHA512

    8381578e5c01a4fd408a541a51672530744d28c709c63eddb9b694782f7e3aff2f6003bb442600d1d3e00be207660cc2820aec8d68dbb0f4ccfb5e096f912432

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1705726.exe

    Filesize

    276KB

    MD5

    8d6941d9069d06551414676978e60296

    SHA1

    f7546b1c90763ab6843d7968b469471931e015c4

    SHA256

    d77295c73bf5a90d082d4fd0dd4a3d552426fc1a019e2b3c1745a9bdf5337728

    SHA512

    e7ebcbf871af3a93bf1a49650822ab989b16350d57e7ee4ddc11d620627c228316cfba59af8c40dd400c1d2e1fa18582d8a7f63685cdfecdf66f1a0535b8e307

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1705726.exe

    Filesize

    276KB

    MD5

    8d6941d9069d06551414676978e60296

    SHA1

    f7546b1c90763ab6843d7968b469471931e015c4

    SHA256

    d77295c73bf5a90d082d4fd0dd4a3d552426fc1a019e2b3c1745a9bdf5337728

    SHA512

    e7ebcbf871af3a93bf1a49650822ab989b16350d57e7ee4ddc11d620627c228316cfba59af8c40dd400c1d2e1fa18582d8a7f63685cdfecdf66f1a0535b8e307

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3352897.exe

    Filesize

    194KB

    MD5

    2c341bec658809b8a24e68d4aa2574e7

    SHA1

    f20f3f328b773befb879f0d8906787ef7373590e

    SHA256

    bde380ea75ab49e6a9ba8adc5463148f1bf0516d48a58aee7d0ebd8aadfa8aa5

    SHA512

    a566038cb8adf3c26c372dec8314f1ad7c03fb34d8142841ed82921458a896b4a285908b091faaccb4496b47c8bc5cea1b25dd4c8b0c32f935df19b2b2d9848e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a3352897.exe

    Filesize

    194KB

    MD5

    2c341bec658809b8a24e68d4aa2574e7

    SHA1

    f20f3f328b773befb879f0d8906787ef7373590e

    SHA256

    bde380ea75ab49e6a9ba8adc5463148f1bf0516d48a58aee7d0ebd8aadfa8aa5

    SHA512

    a566038cb8adf3c26c372dec8314f1ad7c03fb34d8142841ed82921458a896b4a285908b091faaccb4496b47c8bc5cea1b25dd4c8b0c32f935df19b2b2d9848e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1070128.exe

    Filesize

    145KB

    MD5

    df6aa1427910e983167b5de082f93b7a

    SHA1

    253db508c327a7d81145295a146fe448fe91d47e

    SHA256

    5248c87f5e7c3d9acd920073145eb54c0f653d95ad63f8adc1764aedb2223f19

    SHA512

    0901c57d2d70f6cf79636b116da48fd3d4d514e47a8d1544dc77cecd431154ec77a0c5605be7f7baa1495878fb9fb002a216e9cf694e3538d6f2643d9090383b

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b1070128.exe

    Filesize

    145KB

    MD5

    df6aa1427910e983167b5de082f93b7a

    SHA1

    253db508c327a7d81145295a146fe448fe91d47e

    SHA256

    5248c87f5e7c3d9acd920073145eb54c0f653d95ad63f8adc1764aedb2223f19

    SHA512

    0901c57d2d70f6cf79636b116da48fd3d4d514e47a8d1544dc77cecd431154ec77a0c5605be7f7baa1495878fb9fb002a216e9cf694e3538d6f2643d9090383b

  • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    101KB

    MD5

    89d41e1cf478a3d3c2c701a27a5692b2

    SHA1

    691e20583ef80cb9a2fd3258560e7f02481d12fd

    SHA256

    dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

    SHA512

    5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

  • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    101KB

    MD5

    89d41e1cf478a3d3c2c701a27a5692b2

    SHA1

    691e20583ef80cb9a2fd3258560e7f02481d12fd

    SHA256

    dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

    SHA512

    5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

  • C:\Users\Admin\AppData\Local\Temp\c3912af058\oneetx.exe

    Filesize

    101KB

    MD5

    89d41e1cf478a3d3c2c701a27a5692b2

    SHA1

    691e20583ef80cb9a2fd3258560e7f02481d12fd

    SHA256

    dc5ac8d4d6d5b230ab73415c80439b4da77da1cfde18214ef601897f661abdac

    SHA512

    5c9658f6ca0d8d067bfc76072c438ac13daa12d8c1fef33369e1bc36a592d160a2bdb22b4f3eed73e8670bb65107a4134e18e6dc604897a80cc0768769f475dc

  • memory/1872-196-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

  • memory/1872-205-0x0000000004FF0000-0x0000000005000000-memory.dmp

    Filesize

    64KB

  • memory/3112-193-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/3112-191-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/3112-183-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/4328-155-0x0000000000200000-0x000000000020A000-memory.dmp

    Filesize

    40KB

  • memory/4756-163-0x0000000000A10000-0x0000000000A3A000-memory.dmp

    Filesize

    168KB

  • memory/4756-177-0x0000000006C10000-0x0000000006C60000-memory.dmp

    Filesize

    320KB

  • memory/4756-176-0x0000000006E60000-0x0000000006ED6000-memory.dmp

    Filesize

    472KB

  • memory/4756-175-0x00000000054A0000-0x00000000054B0000-memory.dmp

    Filesize

    64KB

  • memory/4756-173-0x0000000007390000-0x00000000078BC000-memory.dmp

    Filesize

    5.2MB

  • memory/4756-172-0x0000000006C90000-0x0000000006E52000-memory.dmp

    Filesize

    1.8MB

  • memory/4756-171-0x0000000005FD0000-0x0000000006036000-memory.dmp

    Filesize

    408KB

  • memory/4756-170-0x0000000006510000-0x0000000006AB4000-memory.dmp

    Filesize

    5.6MB

  • memory/4756-169-0x0000000005780000-0x0000000005812000-memory.dmp

    Filesize

    584KB

  • memory/4756-168-0x0000000005440000-0x000000000547C000-memory.dmp

    Filesize

    240KB

  • memory/4756-167-0x00000000053E0000-0x00000000053F2000-memory.dmp

    Filesize

    72KB

  • memory/4756-166-0x00000000054A0000-0x00000000054B0000-memory.dmp

    Filesize

    64KB

  • memory/4756-165-0x00000000054B0000-0x00000000055BA000-memory.dmp

    Filesize

    1.0MB

  • memory/4756-164-0x0000000005940000-0x0000000005F58000-memory.dmp

    Filesize

    6.1MB