Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/08/2023, 13:52
Static task
static1
Behavioral task
behavioral1
Sample
19e430ece606b3c7a85856d2d0597482.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
19e430ece606b3c7a85856d2d0597482.exe
Resource
win10v2004-20230703-en
General
-
Target
19e430ece606b3c7a85856d2d0597482.exe
-
Size
855KB
-
MD5
19e430ece606b3c7a85856d2d0597482
-
SHA1
86cc5abe88800f485c32391bda6fec463b01296a
-
SHA256
4257603f3ebc986c59d5dd7ca93f69d52a4c673c1eae2c2e53eb7060cb15336c
-
SHA512
5d1e38429bf663e9dec44a81b05c0fc80379d6a48fa513ae895154e9ac2aeb214a1ada8da6ab08ac6df03cab2a4c1f86a4b811f71bdb6d69da77441d85463d07
-
SSDEEP
12288:dMriy905dxAiRWDcc9QsaeCxm46NTtGMxC7PotBzkYHEJ1Atg7Z8Fulh:vywxA/4OpJNtk8tFkPAt2Z8U3
Malware Config
Extracted
redline
dugin
77.91.124.73:19071
-
auth_value
7c3e46e091100fd26a6076996d374c28
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 6 IoCs
pid Process 2776 v1877852.exe 2020 v8901907.exe 2092 v5651983.exe 2948 v2884830.exe 2700 a5739051.exe 2304 b6935053.exe -
Loads dropped DLL 12 IoCs
pid Process 2552 19e430ece606b3c7a85856d2d0597482.exe 2776 v1877852.exe 2776 v1877852.exe 2020 v8901907.exe 2020 v8901907.exe 2092 v5651983.exe 2092 v5651983.exe 2948 v2884830.exe 2948 v2884830.exe 2700 a5739051.exe 2948 v2884830.exe 2304 b6935053.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 19e430ece606b3c7a85856d2d0597482.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v1877852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v8901907.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v5651983.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" v2884830.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2552 wrote to memory of 2776 2552 19e430ece606b3c7a85856d2d0597482.exe 28 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2776 wrote to memory of 2020 2776 v1877852.exe 29 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2020 wrote to memory of 2092 2020 v8901907.exe 30 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2092 wrote to memory of 2948 2092 v5651983.exe 31 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2700 2948 v2884830.exe 32 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33 PID 2948 wrote to memory of 2304 2948 v2884830.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\19e430ece606b3c7a85856d2d0597482.exe"C:\Users\Admin\AppData\Local\Temp\19e430ece606b3c7a85856d2d0597482.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1877852.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1877852.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8901907.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v8901907.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5651983.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5651983.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2884830.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2884830.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5739051.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a5739051.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6935053.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b6935053.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
723KB
MD59c9e65e0e480cffeb4ee7c339577323c
SHA1cd8d4fb101e79afaf12eef43e5a889021d5324d9
SHA2564448b8675cbf7bd0681edfdbc10bb94beccceb07955a7967935bdf9a1d10f592
SHA512210ee20fc577d3dfab1f5023a100eb72e101dbe85e9852b677a43dfb97c262f096901ae19be85054b561295933e7e8744ce8ce9faa372b3781b24414ba98967d
-
Filesize
723KB
MD59c9e65e0e480cffeb4ee7c339577323c
SHA1cd8d4fb101e79afaf12eef43e5a889021d5324d9
SHA2564448b8675cbf7bd0681edfdbc10bb94beccceb07955a7967935bdf9a1d10f592
SHA512210ee20fc577d3dfab1f5023a100eb72e101dbe85e9852b677a43dfb97c262f096901ae19be85054b561295933e7e8744ce8ce9faa372b3781b24414ba98967d
-
Filesize
598KB
MD5cb1b446e52a43e19af04686e74e163f7
SHA1b832db1c9ee21d981a73ff2bf69259e18f334eb9
SHA256b4a1057fcc75a4ab278e5bef33c028936fde1e70cb7881b96d35cd32b42f9fa7
SHA5128659f49c54d4fcd1170b37c9ed78f6a0be82f5512a6abfad7c96f21e20056debbe26015448ae4df1b6fa5422a77483dd54862583cc8bbdced76d90d20b5777ea
-
Filesize
598KB
MD5cb1b446e52a43e19af04686e74e163f7
SHA1b832db1c9ee21d981a73ff2bf69259e18f334eb9
SHA256b4a1057fcc75a4ab278e5bef33c028936fde1e70cb7881b96d35cd32b42f9fa7
SHA5128659f49c54d4fcd1170b37c9ed78f6a0be82f5512a6abfad7c96f21e20056debbe26015448ae4df1b6fa5422a77483dd54862583cc8bbdced76d90d20b5777ea
-
Filesize
372KB
MD5b2a3553bad3a327a02c0aaaed5640bdb
SHA1431991a0c681b720f8d136293862356c45c4ecaf
SHA256831835e7a40c07514df98ba79d798894939aaa379345ef8a38bf372f1e52a9ba
SHA512b273c14c209bbb7babf84cd0daf9f9d84ce2b66fcf5804bccf2b75e0d8c6f134875f50c4760aa4388d2a7d0dc41cf688244fb4b371752dce8dad339461e33db2
-
Filesize
372KB
MD5b2a3553bad3a327a02c0aaaed5640bdb
SHA1431991a0c681b720f8d136293862356c45c4ecaf
SHA256831835e7a40c07514df98ba79d798894939aaa379345ef8a38bf372f1e52a9ba
SHA512b273c14c209bbb7babf84cd0daf9f9d84ce2b66fcf5804bccf2b75e0d8c6f134875f50c4760aa4388d2a7d0dc41cf688244fb4b371752dce8dad339461e33db2
-
Filesize
271KB
MD5176ddff5dd4899dc064ad5aff17192af
SHA1aea89a9aa786cf516bdb078f44d5380c728b8c68
SHA256107f6a8625badcb0327d20cec2642d3f7dfe85831a5c8dc8ee974f4220f40232
SHA5125bb34016a095c6dca6c451c0da482f3e02763f8dfe7fcd9056076ccbb5830b6f86257ad5f92b32eb138a7a898f8212094d95d84b15c46f4cd5a5354e546ba893
-
Filesize
271KB
MD5176ddff5dd4899dc064ad5aff17192af
SHA1aea89a9aa786cf516bdb078f44d5380c728b8c68
SHA256107f6a8625badcb0327d20cec2642d3f7dfe85831a5c8dc8ee974f4220f40232
SHA5125bb34016a095c6dca6c451c0da482f3e02763f8dfe7fcd9056076ccbb5830b6f86257ad5f92b32eb138a7a898f8212094d95d84b15c46f4cd5a5354e546ba893
-
Filesize
140KB
MD577a93a6afb1d7fa81c674cbecbee8531
SHA1fbd5275cea45278e48c3306c5e069619cdf038b3
SHA2560fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
SHA512dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
-
Filesize
140KB
MD577a93a6afb1d7fa81c674cbecbee8531
SHA1fbd5275cea45278e48c3306c5e069619cdf038b3
SHA2560fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
SHA512dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
-
Filesize
173KB
MD5d5f3785f09b0b4ddb516cb1bba85a36d
SHA1978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA25664b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
SHA51240f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
-
Filesize
173KB
MD5d5f3785f09b0b4ddb516cb1bba85a36d
SHA1978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA25664b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
SHA51240f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
-
Filesize
723KB
MD59c9e65e0e480cffeb4ee7c339577323c
SHA1cd8d4fb101e79afaf12eef43e5a889021d5324d9
SHA2564448b8675cbf7bd0681edfdbc10bb94beccceb07955a7967935bdf9a1d10f592
SHA512210ee20fc577d3dfab1f5023a100eb72e101dbe85e9852b677a43dfb97c262f096901ae19be85054b561295933e7e8744ce8ce9faa372b3781b24414ba98967d
-
Filesize
723KB
MD59c9e65e0e480cffeb4ee7c339577323c
SHA1cd8d4fb101e79afaf12eef43e5a889021d5324d9
SHA2564448b8675cbf7bd0681edfdbc10bb94beccceb07955a7967935bdf9a1d10f592
SHA512210ee20fc577d3dfab1f5023a100eb72e101dbe85e9852b677a43dfb97c262f096901ae19be85054b561295933e7e8744ce8ce9faa372b3781b24414ba98967d
-
Filesize
598KB
MD5cb1b446e52a43e19af04686e74e163f7
SHA1b832db1c9ee21d981a73ff2bf69259e18f334eb9
SHA256b4a1057fcc75a4ab278e5bef33c028936fde1e70cb7881b96d35cd32b42f9fa7
SHA5128659f49c54d4fcd1170b37c9ed78f6a0be82f5512a6abfad7c96f21e20056debbe26015448ae4df1b6fa5422a77483dd54862583cc8bbdced76d90d20b5777ea
-
Filesize
598KB
MD5cb1b446e52a43e19af04686e74e163f7
SHA1b832db1c9ee21d981a73ff2bf69259e18f334eb9
SHA256b4a1057fcc75a4ab278e5bef33c028936fde1e70cb7881b96d35cd32b42f9fa7
SHA5128659f49c54d4fcd1170b37c9ed78f6a0be82f5512a6abfad7c96f21e20056debbe26015448ae4df1b6fa5422a77483dd54862583cc8bbdced76d90d20b5777ea
-
Filesize
372KB
MD5b2a3553bad3a327a02c0aaaed5640bdb
SHA1431991a0c681b720f8d136293862356c45c4ecaf
SHA256831835e7a40c07514df98ba79d798894939aaa379345ef8a38bf372f1e52a9ba
SHA512b273c14c209bbb7babf84cd0daf9f9d84ce2b66fcf5804bccf2b75e0d8c6f134875f50c4760aa4388d2a7d0dc41cf688244fb4b371752dce8dad339461e33db2
-
Filesize
372KB
MD5b2a3553bad3a327a02c0aaaed5640bdb
SHA1431991a0c681b720f8d136293862356c45c4ecaf
SHA256831835e7a40c07514df98ba79d798894939aaa379345ef8a38bf372f1e52a9ba
SHA512b273c14c209bbb7babf84cd0daf9f9d84ce2b66fcf5804bccf2b75e0d8c6f134875f50c4760aa4388d2a7d0dc41cf688244fb4b371752dce8dad339461e33db2
-
Filesize
271KB
MD5176ddff5dd4899dc064ad5aff17192af
SHA1aea89a9aa786cf516bdb078f44d5380c728b8c68
SHA256107f6a8625badcb0327d20cec2642d3f7dfe85831a5c8dc8ee974f4220f40232
SHA5125bb34016a095c6dca6c451c0da482f3e02763f8dfe7fcd9056076ccbb5830b6f86257ad5f92b32eb138a7a898f8212094d95d84b15c46f4cd5a5354e546ba893
-
Filesize
271KB
MD5176ddff5dd4899dc064ad5aff17192af
SHA1aea89a9aa786cf516bdb078f44d5380c728b8c68
SHA256107f6a8625badcb0327d20cec2642d3f7dfe85831a5c8dc8ee974f4220f40232
SHA5125bb34016a095c6dca6c451c0da482f3e02763f8dfe7fcd9056076ccbb5830b6f86257ad5f92b32eb138a7a898f8212094d95d84b15c46f4cd5a5354e546ba893
-
Filesize
140KB
MD577a93a6afb1d7fa81c674cbecbee8531
SHA1fbd5275cea45278e48c3306c5e069619cdf038b3
SHA2560fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
SHA512dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
-
Filesize
140KB
MD577a93a6afb1d7fa81c674cbecbee8531
SHA1fbd5275cea45278e48c3306c5e069619cdf038b3
SHA2560fcb9c3965ee7f2c36d232a624e0769542916f207ab4118a1e6d56fabffb3675
SHA512dc09b69e4ba62ccbb61310d39d185ad06e3e74759cfeb193a0d626ee36f35f27dd51f22425985884dd88143c5c24cbbb1da74e105c0adcc33a3a53e9b898d40e
-
Filesize
173KB
MD5d5f3785f09b0b4ddb516cb1bba85a36d
SHA1978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA25664b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
SHA51240f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb
-
Filesize
173KB
MD5d5f3785f09b0b4ddb516cb1bba85a36d
SHA1978b0c33233c9ab63a596cbb282473f1e99b07d4
SHA25664b6558c24af070e047262ad247dc64b968f8d919a5c9bb2b5c279931ef38db0
SHA51240f87989963ef21438f1378eb4b8f4d736bf7de67d2a12670faa6f94ab221dfb475eed8cec99208539e0a06e61ef987f8a7a5cb759442fc79583200b393611fb