Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    140s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2023, 16:11

General

  • Target

    14e66789ed13e60a8e16aae8f6f50b6c26466b75bdef72c289d22514720fa22f.exe

  • Size

    1.0MB

  • MD5

    9a3c2eed6740ec94af81160a13bd1332

  • SHA1

    7d42e79b6b0f490d78edb39b29014118c6c9f839

  • SHA256

    14e66789ed13e60a8e16aae8f6f50b6c26466b75bdef72c289d22514720fa22f

  • SHA512

    b9c15ca26ca2b10ce11b5f90c5eb515cf758e51908e9fe2acabb1edb554d912a009eb0fdb14a723d01a9769e618b907701fe85f4cd677fa20f3ce6f8ea1d1deb

  • SSDEEP

    24576:IydHObmPPxVlJZBvvNXqF/h0EqJFnz0FvOh7T9R+QN:PdHOqPxVlnRv5qnjqXz0FvOh7JR+Q

Malware Config

Extracted

Family

redline

Botnet

narik

C2

77.91.124.82:19071

Attributes
  • auth_value

    07924f5ef90576eb64faea857b8ba3e5

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:728
  • C:\Users\Admin\AppData\Local\Temp\14e66789ed13e60a8e16aae8f6f50b6c26466b75bdef72c289d22514720fa22f.exe
    "C:\Users\Admin\AppData\Local\Temp\14e66789ed13e60a8e16aae8f6f50b6c26466b75bdef72c289d22514720fa22f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5413598.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5413598.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3637545.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3637545.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1056
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2724590.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2724590.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3864
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3030458.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3030458.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2580
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4667749.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4667749.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3416
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4774417.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4774417.exe
              6⤵
              • Executes dropped EXE
              PID:4348
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2271866.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2271866.exe
            5⤵
            • Executes dropped EXE
            PID:4396

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5413598.exe

    Filesize

    933KB

    MD5

    7ccc7820c5eccaa4d9ea8650a16f5acf

    SHA1

    d0c0340560242e50db1370fe3f6252caafaa76c5

    SHA256

    3dfeb3844ddac8fe984a4330dd86ad65c8ca0b40c5e973f5c043dc98e1aa950b

    SHA512

    5d7d4d2d10e447af3499e26cfe41b54709a2a132f68321ea460b59ea6982524ab1d288f080ef60187b65eb0f91aee0f79fa06d8e42d75daea86b4584eda254f9

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5413598.exe

    Filesize

    933KB

    MD5

    7ccc7820c5eccaa4d9ea8650a16f5acf

    SHA1

    d0c0340560242e50db1370fe3f6252caafaa76c5

    SHA256

    3dfeb3844ddac8fe984a4330dd86ad65c8ca0b40c5e973f5c043dc98e1aa950b

    SHA512

    5d7d4d2d10e447af3499e26cfe41b54709a2a132f68321ea460b59ea6982524ab1d288f080ef60187b65eb0f91aee0f79fa06d8e42d75daea86b4584eda254f9

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3637545.exe

    Filesize

    707KB

    MD5

    743522f8c141cf2bf38dddcde74c8346

    SHA1

    fa497735772d859319188ec0169a81015b2d8892

    SHA256

    ed0f0676c56cb0d49e1b4407c7474e5223ed166955d2c6363e7e7163b3c8e0f0

    SHA512

    8cc67047a6e7936cd4e10bf4593c73445c6d195425023c188084afc17ff071f4df99b06df3469930431a8c89fe28a0f8041c26b36c6ed8284844ba877b8dc7d3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3637545.exe

    Filesize

    707KB

    MD5

    743522f8c141cf2bf38dddcde74c8346

    SHA1

    fa497735772d859319188ec0169a81015b2d8892

    SHA256

    ed0f0676c56cb0d49e1b4407c7474e5223ed166955d2c6363e7e7163b3c8e0f0

    SHA512

    8cc67047a6e7936cd4e10bf4593c73445c6d195425023c188084afc17ff071f4df99b06df3469930431a8c89fe28a0f8041c26b36c6ed8284844ba877b8dc7d3

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2724590.exe

    Filesize

    481KB

    MD5

    4ea6679e8756c2a41bfbd6f9f594605b

    SHA1

    6d163b9f4abfe784b4a47fc9d4f4b369ffdd17bc

    SHA256

    12f863f9ea73ed7bbf4dca9f9377833b969280eba281e1248ea3fd2913f07658

    SHA512

    04939708c60c4208e2b76230ecb4939fbfa4b1e26e33a72b43485d930e4481542e468d5866232724090fc76f4baad8c390aab37e0bf9188e44d18bddfb453d76

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2724590.exe

    Filesize

    481KB

    MD5

    4ea6679e8756c2a41bfbd6f9f594605b

    SHA1

    6d163b9f4abfe784b4a47fc9d4f4b369ffdd17bc

    SHA256

    12f863f9ea73ed7bbf4dca9f9377833b969280eba281e1248ea3fd2913f07658

    SHA512

    04939708c60c4208e2b76230ecb4939fbfa4b1e26e33a72b43485d930e4481542e468d5866232724090fc76f4baad8c390aab37e0bf9188e44d18bddfb453d76

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2271866.exe

    Filesize

    174KB

    MD5

    33a260f0c24572e6c3641769be62defe

    SHA1

    921d54aabe73fa807109c11e08ced08d9a342479

    SHA256

    4497b76011c9e083164792791c27d7eb993b23a15292bdec359535ad018ed1cc

    SHA512

    38e8ba5ee2d1b1bef0600e30e1f3172ad3cb55741d7e68e50689b7eb0506bbc95837d7048447f64ee00252f640741d17904abaf9f81635162258f6df66374d72

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2271866.exe

    Filesize

    174KB

    MD5

    33a260f0c24572e6c3641769be62defe

    SHA1

    921d54aabe73fa807109c11e08ced08d9a342479

    SHA256

    4497b76011c9e083164792791c27d7eb993b23a15292bdec359535ad018ed1cc

    SHA512

    38e8ba5ee2d1b1bef0600e30e1f3172ad3cb55741d7e68e50689b7eb0506bbc95837d7048447f64ee00252f640741d17904abaf9f81635162258f6df66374d72

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3030458.exe

    Filesize

    325KB

    MD5

    4f937918b99f66ebc055e353a1dfa7b0

    SHA1

    2519013bbceebf8b818ae54475c324bdb027f7b4

    SHA256

    2d4b4ce52512cd2b1601fe4bbbf0efb70e49db7ee132a0684218a727d5dad823

    SHA512

    eafd03a0b08e779c9cf8215a9c72d723fa51658f9551bfd39cb7a0408b68c671c132513e47f932aded611586305358544e2cbd895d840d300d0072228f413a7c

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3030458.exe

    Filesize

    325KB

    MD5

    4f937918b99f66ebc055e353a1dfa7b0

    SHA1

    2519013bbceebf8b818ae54475c324bdb027f7b4

    SHA256

    2d4b4ce52512cd2b1601fe4bbbf0efb70e49db7ee132a0684218a727d5dad823

    SHA512

    eafd03a0b08e779c9cf8215a9c72d723fa51658f9551bfd39cb7a0408b68c671c132513e47f932aded611586305358544e2cbd895d840d300d0072228f413a7c

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4667749.exe

    Filesize

    184KB

    MD5

    393eaf507da66accaee3287a692cb486

    SHA1

    98c4ba0f2bb3083e3e135fac4f58c944dacacd08

    SHA256

    046293b6edc1ff51afca5d2444a6d1f6d7145e21aced1557ef5316c5b21e3625

    SHA512

    1363b04b614e050f480a017268ec79d4b2a6006291f3239aef1cde7788979d9b47c8902b105190a5e2300656a8c9404b153d3139546810d175d3ec66e8b71e04

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4667749.exe

    Filesize

    184KB

    MD5

    393eaf507da66accaee3287a692cb486

    SHA1

    98c4ba0f2bb3083e3e135fac4f58c944dacacd08

    SHA256

    046293b6edc1ff51afca5d2444a6d1f6d7145e21aced1557ef5316c5b21e3625

    SHA512

    1363b04b614e050f480a017268ec79d4b2a6006291f3239aef1cde7788979d9b47c8902b105190a5e2300656a8c9404b153d3139546810d175d3ec66e8b71e04

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4774417.exe

    Filesize

    141KB

    MD5

    960cc2d1dd5faaabd1f7b6acdff0070a

    SHA1

    8c32a3ad20db00d9b72111ab502b237a817ae84a

    SHA256

    703cabd7710308678c504a8749d8fefafdd70207284db96551629d06997863bc

    SHA512

    9b25e1d2e389f923013fb297087540c8af0dce64645f857042705879be30ea3f4355ce8868d9becc13973efa8810c4597b09897fa559b24401ef30bf6eebc720

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4774417.exe

    Filesize

    141KB

    MD5

    960cc2d1dd5faaabd1f7b6acdff0070a

    SHA1

    8c32a3ad20db00d9b72111ab502b237a817ae84a

    SHA256

    703cabd7710308678c504a8749d8fefafdd70207284db96551629d06997863bc

    SHA512

    9b25e1d2e389f923013fb297087540c8af0dce64645f857042705879be30ea3f4355ce8868d9becc13973efa8810c4597b09897fa559b24401ef30bf6eebc720

  • memory/3416-43-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

    Filesize

    64KB

  • memory/3416-74-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/3416-49-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-51-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-53-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-55-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-57-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-59-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-61-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-63-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-65-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-67-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-69-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-71-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-73-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-46-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-75-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

    Filesize

    64KB

  • memory/3416-76-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

    Filesize

    64KB

  • memory/3416-78-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/3416-47-0x00000000049B0000-0x00000000049C6000-memory.dmp

    Filesize

    88KB

  • memory/3416-45-0x0000000004AF0000-0x0000000005094000-memory.dmp

    Filesize

    5.6MB

  • memory/3416-44-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

    Filesize

    64KB

  • memory/3416-42-0x00000000746D0000-0x0000000074E80000-memory.dmp

    Filesize

    7.7MB

  • memory/4396-86-0x0000000074750000-0x0000000074F00000-memory.dmp

    Filesize

    7.7MB

  • memory/4396-85-0x0000000000DF0000-0x0000000000E20000-memory.dmp

    Filesize

    192KB

  • memory/4396-87-0x000000000B200000-0x000000000B818000-memory.dmp

    Filesize

    6.1MB

  • memory/4396-88-0x000000000ACF0000-0x000000000ADFA000-memory.dmp

    Filesize

    1.0MB

  • memory/4396-89-0x0000000005850000-0x0000000005860000-memory.dmp

    Filesize

    64KB

  • memory/4396-90-0x0000000005810000-0x0000000005822000-memory.dmp

    Filesize

    72KB

  • memory/4396-91-0x000000000AC20000-0x000000000AC5C000-memory.dmp

    Filesize

    240KB

  • memory/4396-92-0x0000000074750000-0x0000000074F00000-memory.dmp

    Filesize

    7.7MB

  • memory/4396-93-0x0000000005850000-0x0000000005860000-memory.dmp

    Filesize

    64KB