Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 22:15

General

  • Target

    e67313cba3a83416503c6f073acb35d56e8f17f55f3c0118d89f8e167ed02c81.exe

  • Size

    767KB

  • MD5

    914cb5cdd7b966d2c49b0b4e2a64fe22

  • SHA1

    e4b9ffc772d4c8c3e4a6e8135d1aafc7816e0cba

  • SHA256

    e67313cba3a83416503c6f073acb35d56e8f17f55f3c0118d89f8e167ed02c81

  • SHA512

    acc0f82d4d8b6de95444ff6fe82957fbb05ddac5c4f64825fd224ebd0d6dfd578619d68f2314843939991bfa74cd1f481d03dde276256f21eaa902fa10e93431

  • SSDEEP

    12288:2Mr3y90gcHukaOYbDxBeC9CepJ5OjjEmqqBijHvGkBrhnM8tIW+MEU8pxb:Ry+HukaOYxBezwxmqqBwukdhM81+e8pF

Malware Config

Extracted

Family

redline

Botnet

dina

C2

83.97.73.122:19062

Attributes
  • auth_value

    4f77073adc624269de1bff760b9bc471

Extracted

Family

redline

Botnet

greg

C2

83.97.73.122:19062

Attributes
  • auth_value

    4c966a90781c6b4ab7f512d018696362

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 58 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e67313cba3a83416503c6f073acb35d56e8f17f55f3c0118d89f8e167ed02c81.exe
    "C:\Users\Admin\AppData\Local\Temp\e67313cba3a83416503c6f073acb35d56e8f17f55f3c0118d89f8e167ed02c81.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5483751.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5483751.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7687951.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7687951.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3816
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0465995.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0465995.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2280
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4920
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9319008.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9319008.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2596
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6294161.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6294161.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2288
        • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
          "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4704
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN metado.exe /TR "C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:648
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "metado.exe" /P "Admin:N"&&CACLS "metado.exe" /P "Admin:R" /E&&echo Y|CACLS "..\a9e2a16078" /P "Admin:N"&&CACLS "..\a9e2a16078" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3872
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:4344
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "metado.exe" /P "Admin:N"
                6⤵
                  PID:4052
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "metado.exe" /P "Admin:R" /E
                  6⤵
                    PID:4596
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "..\a9e2a16078" /P "Admin:N"
                    6⤵
                      PID:3664
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      6⤵
                        PID:4644
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\a9e2a16078" /P "Admin:R" /E
                        6⤵
                          PID:3320
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:3864
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7387766.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7387766.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:3860
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3416
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:1856
              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe
                1⤵
                • Executes dropped EXE
                PID:5064

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7387766.exe

                Filesize

                322KB

                MD5

                37c832cb66f97214f6728e49a39bd75b

                SHA1

                5ab311c7815b35c9c216a64cc7683153eb386ef4

                SHA256

                b61c5ac4beb102e8e72f713188526285227cba72dc9132433e325d4b121a8583

                SHA512

                e841dc601cf7d07b45b661f298aa16c74f36918e1c07cfca35a1fb3936d8035fb572d327a09f7e8a47c6174d3229921324f38f67baee6f51ce1bf56873c11eef

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n7387766.exe

                Filesize

                322KB

                MD5

                37c832cb66f97214f6728e49a39bd75b

                SHA1

                5ab311c7815b35c9c216a64cc7683153eb386ef4

                SHA256

                b61c5ac4beb102e8e72f713188526285227cba72dc9132433e325d4b121a8583

                SHA512

                e841dc601cf7d07b45b661f298aa16c74f36918e1c07cfca35a1fb3936d8035fb572d327a09f7e8a47c6174d3229921324f38f67baee6f51ce1bf56873c11eef

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5483751.exe

                Filesize

                448KB

                MD5

                eb81e552d75a33be96e9dbdf309d3449

                SHA1

                77be5f1ed06ec8ddf6033b54960d49f12924d630

                SHA256

                264a3bd566e5754c9ff58dcdf888bc0845ebfa474ee837099028d3accb707f02

                SHA512

                da9c0f9d636789255a7fa062511d525d8596e25b8f8701d2c7091725a34871e20ffdaab39bcd4983f48ec467a7ea5d903205dfe66945e2bb8763c1b8f34bb085

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5483751.exe

                Filesize

                448KB

                MD5

                eb81e552d75a33be96e9dbdf309d3449

                SHA1

                77be5f1ed06ec8ddf6033b54960d49f12924d630

                SHA256

                264a3bd566e5754c9ff58dcdf888bc0845ebfa474ee837099028d3accb707f02

                SHA512

                da9c0f9d636789255a7fa062511d525d8596e25b8f8701d2c7091725a34871e20ffdaab39bcd4983f48ec467a7ea5d903205dfe66945e2bb8763c1b8f34bb085

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6294161.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6294161.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7687951.exe

                Filesize

                277KB

                MD5

                609a3f968937fcc4792719d9f7e8190d

                SHA1

                d4e1317fa188d3be4ea54f8e3f4fe94574204695

                SHA256

                31f5ff8c2ad29247e5c2b4690d6a157a83ed659f0f30f00e3c197ce1a2959133

                SHA512

                1b444747f9f742c751cd0e630c79ff1b12b727604e551b08891bbc418c493e3239f71839acdf0f06f5ff792f7abe668a911cf2462435873223bb7f16d6ba5182

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7687951.exe

                Filesize

                277KB

                MD5

                609a3f968937fcc4792719d9f7e8190d

                SHA1

                d4e1317fa188d3be4ea54f8e3f4fe94574204695

                SHA256

                31f5ff8c2ad29247e5c2b4690d6a157a83ed659f0f30f00e3c197ce1a2959133

                SHA512

                1b444747f9f742c751cd0e630c79ff1b12b727604e551b08891bbc418c493e3239f71839acdf0f06f5ff792f7abe668a911cf2462435873223bb7f16d6ba5182

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0465995.exe

                Filesize

                188KB

                MD5

                bb9c8129826fa4cbd27b2ab09704bbf8

                SHA1

                f3071823b4534a1454443a07cbedf3488ddb2b53

                SHA256

                1b0f0341ed5a215f0c3ef56e4a05f0670c1be3d221196256a8891897a309e739

                SHA512

                43e43e95f4f7aec374170992d36f2ed94f70631609351a5ec452068afb96bf06aa2e862cd8825b28938cbad46f0417933392d79bb1463e9d1668d60039c879c6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k0465995.exe

                Filesize

                188KB

                MD5

                bb9c8129826fa4cbd27b2ab09704bbf8

                SHA1

                f3071823b4534a1454443a07cbedf3488ddb2b53

                SHA256

                1b0f0341ed5a215f0c3ef56e4a05f0670c1be3d221196256a8891897a309e739

                SHA512

                43e43e95f4f7aec374170992d36f2ed94f70631609351a5ec452068afb96bf06aa2e862cd8825b28938cbad46f0417933392d79bb1463e9d1668d60039c879c6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9319008.exe

                Filesize

                145KB

                MD5

                858debe3ff422b06ca211cb925cc8d4f

                SHA1

                762a4afd63f5957f475b149d7fc45f801c58ffc5

                SHA256

                ce1ee53ff9c5ddb2ea1a0fe8b07c1b53e6cfba6af81fadac32b3ec02dba39b45

                SHA512

                f0269e5d6e33f81dffb3e7224f852ac6a7402ee2ec9bc1494212178123d5630806aad6eca5d70583d264e3e7f01aafc3723188b3a3a64ed8296f36f8c63279d2

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l9319008.exe

                Filesize

                145KB

                MD5

                858debe3ff422b06ca211cb925cc8d4f

                SHA1

                762a4afd63f5957f475b149d7fc45f801c58ffc5

                SHA256

                ce1ee53ff9c5ddb2ea1a0fe8b07c1b53e6cfba6af81fadac32b3ec02dba39b45

                SHA512

                f0269e5d6e33f81dffb3e7224f852ac6a7402ee2ec9bc1494212178123d5630806aad6eca5d70583d264e3e7f01aafc3723188b3a3a64ed8296f36f8c63279d2

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Local\Temp\a9e2a16078\metado.exe

                Filesize

                205KB

                MD5

                9b154a2c5c12670536444b0da17ba36d

                SHA1

                878649d4ae64b75d89a0d440a1c9952cc238fa34

                SHA256

                c973cdc9a9430ce78f9d96f820a2fb2a8769b79f4f763ae50dda61c382a5f95c

                SHA512

                75265c69f02632660431b4daafbf3d1248ed14be358a63261a2bcda4a05b3c2c5dd63bf2ce0aba0133c0fd3465acf5be951e94b100ad613b8deb0197cfa76306

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                547bae937be965d63f61d89e8eafb4a1

                SHA1

                85466c95625bcbb7f68aa89a367149d35f80e1fa

                SHA256

                015d60486e75035f83ea454e87afb38d11ec39643c33b07f61a40343078ee4f5

                SHA512

                1869b1cd3dcc09fbf9f965a8f45b647390e8859e6bf476293cbfd8b1122c660eca5db2943f0b1e77d451684fdef34ae503d5f357408e1a4fe5c1237871f5d02f

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/2596-163-0x0000000000A30000-0x0000000000A5A000-memory.dmp

                Filesize

                168KB

              • memory/2596-169-0x00000000057A0000-0x0000000005832000-memory.dmp

                Filesize

                584KB

              • memory/2596-176-0x0000000006E70000-0x0000000006EE6000-memory.dmp

                Filesize

                472KB

              • memory/2596-175-0x0000000005790000-0x00000000057A0000-memory.dmp

                Filesize

                64KB

              • memory/2596-174-0x00000000073A0000-0x00000000078CC000-memory.dmp

                Filesize

                5.2MB

              • memory/2596-173-0x0000000006CA0000-0x0000000006E62000-memory.dmp

                Filesize

                1.8MB

              • memory/2596-171-0x0000000005FE0000-0x0000000006046000-memory.dmp

                Filesize

                408KB

              • memory/2596-170-0x0000000006520000-0x0000000006AC4000-memory.dmp

                Filesize

                5.6MB

              • memory/2596-164-0x0000000005950000-0x0000000005F68000-memory.dmp

                Filesize

                6.1MB

              • memory/2596-177-0x0000000006C30000-0x0000000006C80000-memory.dmp

                Filesize

                320KB

              • memory/2596-165-0x00000000054D0000-0x00000000055DA000-memory.dmp

                Filesize

                1.0MB

              • memory/2596-168-0x0000000005790000-0x00000000057A0000-memory.dmp

                Filesize

                64KB

              • memory/2596-167-0x0000000005460000-0x000000000549C000-memory.dmp

                Filesize

                240KB

              • memory/2596-166-0x0000000005400000-0x0000000005412000-memory.dmp

                Filesize

                72KB

              • memory/3416-202-0x0000000005300000-0x0000000005310000-memory.dmp

                Filesize

                64KB

              • memory/3416-196-0x0000000000400000-0x000000000042A000-memory.dmp

                Filesize

                168KB

              • memory/4920-155-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB