Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2023, 13:13

General

  • Target

    65d18df23c60d9f0d917880da59d3ddb81483462d1253283c8c526874c8839d9.exe

  • Size

    582KB

  • MD5

    2b77bacb2ac69963039eb41199eee479

  • SHA1

    5af531f1fd5f1da98d881a63b478bb274287f381

  • SHA256

    65d18df23c60d9f0d917880da59d3ddb81483462d1253283c8c526874c8839d9

  • SHA512

    26d4146ca3355b18448493df40528ca83c8f26cf96d4801629c451635771a1113612e60edb3cac4c290173dd20705a01156dc0d969a76a17fdb50764e891cc39

  • SSDEEP

    12288:tLDfczWW/AgKv/wrpnGk6lfSPMn2nOwZDfPFb/Xj:tffiKSMXlq0wtBDXj

Malware Config

Extracted

Family

redline

Botnet

gena

C2

185.161.248.73:4164

Attributes
  • auth_value

    d05bf43eef533e262271449829751d07

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65d18df23c60d9f0d917880da59d3ddb81483462d1253283c8c526874c8839d9.exe
    "C:\Users\Admin\AppData\Local\Temp\65d18df23c60d9f0d917880da59d3ddb81483462d1253283c8c526874c8839d9.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Windows\Temp\1.exe
      "C:\Windows\Temp\1.exe"
      2⤵
      • Executes dropped EXE
      PID:1392
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 1312
      2⤵
      • Program crash
      PID:2416
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4424 -ip 4424
    1⤵
      PID:4288

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      f16fb63d4e551d3808e8f01f2671b57e

      SHA1

      781153ad6235a1152da112de1fb39a6f2d063575

      SHA256

      8a34627d2a802a7222661926a21bfe7e05835d8dca23459a50c62ccac4619581

      SHA512

      fad96ade34ff0637238ebf22941dcf21d9ddbe41e10b04d32a904c6018e0c9914345fc86e0ef8c27b95e3813eb60af233b2e47a585c150b9d1c14d48906f78cf

    • memory/1392-2317-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

      Filesize

      64KB

    • memory/1392-2316-0x0000000074630000-0x0000000074DE0000-memory.dmp

      Filesize

      7.7MB

    • memory/1392-2312-0x0000000005100000-0x000000000513C000-memory.dmp

      Filesize

      240KB

    • memory/1392-2311-0x0000000004F80000-0x0000000004F92000-memory.dmp

      Filesize

      72KB

    • memory/1392-2310-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

      Filesize

      64KB

    • memory/1392-2309-0x00000000051D0000-0x00000000052DA000-memory.dmp

      Filesize

      1.0MB

    • memory/1392-2308-0x00000000056E0000-0x0000000005CF8000-memory.dmp

      Filesize

      6.1MB

    • memory/1392-2307-0x0000000074630000-0x0000000074DE0000-memory.dmp

      Filesize

      7.7MB

    • memory/1392-2306-0x0000000000720000-0x000000000074E000-memory.dmp

      Filesize

      184KB

    • memory/4424-157-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-197-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-155-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-134-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

      Filesize

      1024KB

    • memory/4424-159-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-161-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-163-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-165-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-167-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-169-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-171-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-173-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-175-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-177-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-179-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-181-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-183-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-185-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-189-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-187-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-191-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-193-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-195-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-153-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-199-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-201-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-203-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-527-0x0000000000AA0000-0x0000000000BA0000-memory.dmp

      Filesize

      1024KB

    • memory/4424-1165-0x0000000002440000-0x000000000249B000-memory.dmp

      Filesize

      364KB

    • memory/4424-1537-0x0000000000400000-0x0000000000837000-memory.dmp

      Filesize

      4.2MB

    • memory/4424-1539-0x0000000074630000-0x0000000074DE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4424-2027-0x0000000004F20000-0x0000000004F30000-memory.dmp

      Filesize

      64KB

    • memory/4424-2292-0x0000000004F20000-0x0000000004F30000-memory.dmp

      Filesize

      64KB

    • memory/4424-151-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-149-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-147-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-2305-0x0000000004F20000-0x0000000004F30000-memory.dmp

      Filesize

      64KB

    • memory/4424-145-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-143-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-141-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-140-0x0000000005560000-0x00000000055C0000-memory.dmp

      Filesize

      384KB

    • memory/4424-139-0x0000000004F70000-0x0000000005514000-memory.dmp

      Filesize

      5.6MB

    • memory/4424-138-0x0000000004F20000-0x0000000004F30000-memory.dmp

      Filesize

      64KB

    • memory/4424-137-0x0000000074630000-0x0000000074DE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4424-2314-0x0000000000400000-0x0000000000837000-memory.dmp

      Filesize

      4.2MB

    • memory/4424-2315-0x0000000074630000-0x0000000074DE0000-memory.dmp

      Filesize

      7.7MB

    • memory/4424-136-0x0000000000400000-0x0000000000837000-memory.dmp

      Filesize

      4.2MB

    • memory/4424-135-0x0000000002440000-0x000000000249B000-memory.dmp

      Filesize

      364KB