Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    95s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 10:47

General

  • Target

    6cdaf252160ad61c48179abd1addd6d8f349c37938c15349e12ab9c780f5acec.exe

  • Size

    1.0MB

  • MD5

    d78b03ed997b0876100c13ee63f0337d

  • SHA1

    2c3b2f4bee6d10573309ef0d6bcb13722140e6b9

  • SHA256

    6cdaf252160ad61c48179abd1addd6d8f349c37938c15349e12ab9c780f5acec

  • SHA512

    64eda43b17557965e4af2b0214f3bf5327f0f805e0e07260de467056d2f47990a0e0ef23115e504db14d9b225a691737734e1daf24fb5cef2dcf856010dff7ca

  • SSDEEP

    24576:qyvv74z2bQX0kiQ+3YSaDgNXJflDoXSbBgDo0BfuN:xv0+Qkkp+bacNIXS1gD

Malware Config

Extracted

Family

redline

Botnet

diza

C2

83.97.73.122:19062

Attributes
  • auth_value

    0d09b419c8bc967f91c68be4a17e92ee

Extracted

Family

redline

Botnet

fash

C2

83.97.73.122:19062

Attributes
  • auth_value

    dd7165bcd22b0ed3df426d944e12f136

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6cdaf252160ad61c48179abd1addd6d8f349c37938c15349e12ab9c780f5acec.exe
    "C:\Users\Admin\AppData\Local\Temp\6cdaf252160ad61c48179abd1addd6d8f349c37938c15349e12ab9c780f5acec.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5966302.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5966302.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7516541.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7516541.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3668
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9268293.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9268293.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1560
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9048909.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9048909.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:388
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2508
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of UnmapMainImage
          PID:2408
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 12
            5⤵
            • Program crash
            PID:4380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i3658062.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i3658062.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2884
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1028
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2408 -ip 2408
    1⤵
      PID:5076

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

      Filesize

      226B

      MD5

      916851e072fbabc4796d8916c5131092

      SHA1

      d48a602229a690c512d5fdaf4c8d77547a88e7a2

      SHA256

      7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

      SHA512

      07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i3658062.exe

      Filesize

      328KB

      MD5

      fe08dd88a363323c2b66a69d7a3bfa61

      SHA1

      9b41a9964c6c86a9767c3c50d7fec8d4be3e2b20

      SHA256

      d50731a345f2c88e328717da4fbd32ff0410974d9482cebb4e53ec788b83b6c9

      SHA512

      6f25678f6d042a96402610b33a3efec0f44f8610cda0fd0505f6d1d5ff59be7e0498db7db788beec06639048a0a1b81f96eb037c398857a99bf7f1664461a18d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i3658062.exe

      Filesize

      328KB

      MD5

      fe08dd88a363323c2b66a69d7a3bfa61

      SHA1

      9b41a9964c6c86a9767c3c50d7fec8d4be3e2b20

      SHA256

      d50731a345f2c88e328717da4fbd32ff0410974d9482cebb4e53ec788b83b6c9

      SHA512

      6f25678f6d042a96402610b33a3efec0f44f8610cda0fd0505f6d1d5ff59be7e0498db7db788beec06639048a0a1b81f96eb037c398857a99bf7f1664461a18d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5966302.exe

      Filesize

      725KB

      MD5

      131ed69f9fe2b38cbee30a417ab07c41

      SHA1

      c8272b82f183bd76baf277523c13141aeb4da3d3

      SHA256

      07f4b1e90369545f2ffc85b7f84b8dc1c962c3f8cee129e888b299d66e9c1aa6

      SHA512

      8549bd87c2028ea80657300613fdfb69545661bebf6d0c0fed47c2d8aae6e5baa442efe0029354b73a52a7e6a3e8ddb893e8d8dd9230b5beb30967cd144dbcec

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5966302.exe

      Filesize

      725KB

      MD5

      131ed69f9fe2b38cbee30a417ab07c41

      SHA1

      c8272b82f183bd76baf277523c13141aeb4da3d3

      SHA256

      07f4b1e90369545f2ffc85b7f84b8dc1c962c3f8cee129e888b299d66e9c1aa6

      SHA512

      8549bd87c2028ea80657300613fdfb69545661bebf6d0c0fed47c2d8aae6e5baa442efe0029354b73a52a7e6a3e8ddb893e8d8dd9230b5beb30967cd144dbcec

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe

      Filesize

      963KB

      MD5

      5d350a428cb5924af4fd3b17ee76dd3b

      SHA1

      b59314018cd00304eb150963b6b0173f678d92e7

      SHA256

      32d732e3025d9b4564f2ec8088c229b2de35625ff45ecc042dcfbc2dce38b397

      SHA512

      418f18139f462a242c8decc5f3e72d1a2f660a047a514450897a59ef80634688296dbddfc67e86f948d106e4221ab6808e070047b025baf82af6540b626a2571

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe

      Filesize

      963KB

      MD5

      5d350a428cb5924af4fd3b17ee76dd3b

      SHA1

      b59314018cd00304eb150963b6b0173f678d92e7

      SHA256

      32d732e3025d9b4564f2ec8088c229b2de35625ff45ecc042dcfbc2dce38b397

      SHA512

      418f18139f462a242c8decc5f3e72d1a2f660a047a514450897a59ef80634688296dbddfc67e86f948d106e4221ab6808e070047b025baf82af6540b626a2571

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h7271269.exe

      Filesize

      963KB

      MD5

      5d350a428cb5924af4fd3b17ee76dd3b

      SHA1

      b59314018cd00304eb150963b6b0173f678d92e7

      SHA256

      32d732e3025d9b4564f2ec8088c229b2de35625ff45ecc042dcfbc2dce38b397

      SHA512

      418f18139f462a242c8decc5f3e72d1a2f660a047a514450897a59ef80634688296dbddfc67e86f948d106e4221ab6808e070047b025baf82af6540b626a2571

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7516541.exe

      Filesize

      280KB

      MD5

      b2eca5afa1a163643e7bc0013c5128b5

      SHA1

      9f2dc292160f5a061d196f5068c29c2079bfd99e

      SHA256

      dfd9359c1da79300636e1811194ffaa63c928c0e3ecdfd7ef18542bb8ae8178f

      SHA512

      b55bcdecfe70463d01166c4174c6991ad025ef26c3c43d5679d9c70c4dcd24df163b4216b630fcce32e78c3a5126f6333087231dd67c2a2d7990f92268fd9739

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7516541.exe

      Filesize

      280KB

      MD5

      b2eca5afa1a163643e7bc0013c5128b5

      SHA1

      9f2dc292160f5a061d196f5068c29c2079bfd99e

      SHA256

      dfd9359c1da79300636e1811194ffaa63c928c0e3ecdfd7ef18542bb8ae8178f

      SHA512

      b55bcdecfe70463d01166c4174c6991ad025ef26c3c43d5679d9c70c4dcd24df163b4216b630fcce32e78c3a5126f6333087231dd67c2a2d7990f92268fd9739

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9268293.exe

      Filesize

      146KB

      MD5

      edb5d31b81c54121046aebec3849084f

      SHA1

      81a4979d7c4944f77582f003d17ce484a2cceb09

      SHA256

      78887fe879c5d8866d626db502b0e0481e6cb9f914fe8a1111685eacabde45a5

      SHA512

      bea16611584d323d3b287c90e6972fd8fbee8899679ff46cc660ff9c12567a2c4afe761d81414d99111a599b776507ccb8724f67ea3c9dddc3d80948d656513a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f9268293.exe

      Filesize

      146KB

      MD5

      edb5d31b81c54121046aebec3849084f

      SHA1

      81a4979d7c4944f77582f003d17ce484a2cceb09

      SHA256

      78887fe879c5d8866d626db502b0e0481e6cb9f914fe8a1111685eacabde45a5

      SHA512

      bea16611584d323d3b287c90e6972fd8fbee8899679ff46cc660ff9c12567a2c4afe761d81414d99111a599b776507ccb8724f67ea3c9dddc3d80948d656513a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9048909.exe

      Filesize

      194KB

      MD5

      1f7bc5ba4a71204b5d0c935761b63688

      SHA1

      b2055c1c0b046dd69cb7d7221e2f9b8d0b23192c

      SHA256

      fb638d288e95f4ea89efb12c8963028d3f8250ac3205c3a687f8c34070473009

      SHA512

      a8b75d76e74cc9a6537acd9375fd24156642d5cf29098dabad8859680e87ba1de6cdea8ed0dfe2e943737cf3f4aa62d40aca4e0d3dfb5d298f171fc27af642ae

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g9048909.exe

      Filesize

      194KB

      MD5

      1f7bc5ba4a71204b5d0c935761b63688

      SHA1

      b2055c1c0b046dd69cb7d7221e2f9b8d0b23192c

      SHA256

      fb638d288e95f4ea89efb12c8963028d3f8250ac3205c3a687f8c34070473009

      SHA512

      a8b75d76e74cc9a6537acd9375fd24156642d5cf29098dabad8859680e87ba1de6cdea8ed0dfe2e943737cf3f4aa62d40aca4e0d3dfb5d298f171fc27af642ae

    • memory/1028-195-0x0000000005240000-0x0000000005250000-memory.dmp

      Filesize

      64KB

    • memory/1028-190-0x0000000000400000-0x000000000042A000-memory.dmp

      Filesize

      168KB

    • memory/1560-156-0x0000000005840000-0x000000000594A000-memory.dmp

      Filesize

      1.0MB

    • memory/1560-159-0x0000000005750000-0x0000000005760000-memory.dmp

      Filesize

      64KB

    • memory/1560-166-0x0000000007810000-0x0000000007D3C000-memory.dmp

      Filesize

      5.2MB

    • memory/1560-167-0x0000000005750000-0x0000000005760000-memory.dmp

      Filesize

      64KB

    • memory/1560-164-0x0000000006840000-0x0000000006890000-memory.dmp

      Filesize

      320KB

    • memory/1560-163-0x00000000067C0000-0x0000000006836000-memory.dmp

      Filesize

      472KB

    • memory/1560-154-0x0000000000DA0000-0x0000000000DCA000-memory.dmp

      Filesize

      168KB

    • memory/1560-162-0x0000000006350000-0x00000000063B6000-memory.dmp

      Filesize

      408KB

    • memory/1560-161-0x0000000006890000-0x0000000006E34000-memory.dmp

      Filesize

      5.6MB

    • memory/1560-155-0x0000000005CC0000-0x00000000062D8000-memory.dmp

      Filesize

      6.1MB

    • memory/1560-157-0x0000000005780000-0x0000000005792000-memory.dmp

      Filesize

      72KB

    • memory/1560-158-0x00000000057E0000-0x000000000581C000-memory.dmp

      Filesize

      240KB

    • memory/1560-160-0x0000000005B10000-0x0000000005BA2000-memory.dmp

      Filesize

      584KB

    • memory/1560-165-0x0000000007110000-0x00000000072D2000-memory.dmp

      Filesize

      1.8MB

    • memory/2408-183-0x0000000000400000-0x0000000000438000-memory.dmp

      Filesize

      224KB

    • memory/2508-173-0x0000000000400000-0x000000000040A000-memory.dmp

      Filesize

      40KB

    • memory/3548-182-0x0000000006F10000-0x0000000006F20000-memory.dmp

      Filesize

      64KB

    • memory/3548-181-0x0000000000070000-0x0000000000168000-memory.dmp

      Filesize

      992KB