Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe
Resource
win10v2004-20230915-en
General
-
Target
40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe
-
Size
1.3MB
-
MD5
9edc522f25bfe83833ad86194a159f7f
-
SHA1
e0a58ecbc04824bef6842168ddee3d7312bb9d41
-
SHA256
40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3
-
SHA512
f61b30021f0e61db9c408522d955d9dd9be5cce1471267c8858c2b84b3d28c92740b3f16e131038a83d32f858b3a3ad586826e235e48d328987c029085e04fa4
-
SSDEEP
24576:zQWR5eYC8xWOKih0psqSXidHFeTUPyoe426pAt3kHzz8rzJIf9s:r5eYC8xbKlpV2apPa+p03izg36f9s
Malware Config
Extracted
redline
vasha
77.91.124.82:19071
-
auth_value
42fc61786274daca54d589b85a2c1954
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 5 IoCs
pid Process 2512 x1145471.exe 1304 x7489521.exe 2976 x8753988.exe 2204 g9581292.exe 4900 h7637906.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" AppLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1145471.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x7489521.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" x8753988.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2032 set thread context of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 -
Program crash 1 IoCs
pid pid_target Process procid_target 2948 2204 WerFault.exe 92 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 2032 wrote to memory of 1684 2032 40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe 88 PID 1684 wrote to memory of 2512 1684 AppLaunch.exe 89 PID 1684 wrote to memory of 2512 1684 AppLaunch.exe 89 PID 1684 wrote to memory of 2512 1684 AppLaunch.exe 89 PID 2512 wrote to memory of 1304 2512 x1145471.exe 90 PID 2512 wrote to memory of 1304 2512 x1145471.exe 90 PID 2512 wrote to memory of 1304 2512 x1145471.exe 90 PID 1304 wrote to memory of 2976 1304 x7489521.exe 91 PID 1304 wrote to memory of 2976 1304 x7489521.exe 91 PID 1304 wrote to memory of 2976 1304 x7489521.exe 91 PID 2976 wrote to memory of 2204 2976 x8753988.exe 92 PID 2976 wrote to memory of 2204 2976 x8753988.exe 92 PID 2976 wrote to memory of 2204 2976 x8753988.exe 92 PID 2976 wrote to memory of 4900 2976 x8753988.exe 96 PID 2976 wrote to memory of 4900 2976 x8753988.exe 96 PID 2976 wrote to memory of 4900 2976 x8753988.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe"C:\Users\Admin\AppData\Local\Temp\40001deebcf679f212c0c7b1213c60432ac9f31217888a0791cc476b407d00b3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1145471.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1145471.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7489521.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7489521.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8753988.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x8753988.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9581292.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9581292.exe6⤵
- Executes dropped EXE
PID:2204 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 2167⤵
- Program crash
PID:2948
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7637906.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7637906.exe6⤵
- Executes dropped EXE
PID:4900
-
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2204 -ip 22041⤵PID:3516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
776KB
MD59f7d47cc39e080fc659822946b475f9f
SHA1fb2888e45914f510e663d666c0f29817bed6ebc1
SHA25691ef900a0c0d683389067118e5f6368926a16fb46c4b6643faa2ca3beb82f733
SHA512d540026c28cf0f023d7acbaf4ba61780397c7886c605d8593e4cce43f58664b4db267320022a29557609397f1e141e097cf5e1727de4b426588decc134367576
-
Filesize
776KB
MD59f7d47cc39e080fc659822946b475f9f
SHA1fb2888e45914f510e663d666c0f29817bed6ebc1
SHA25691ef900a0c0d683389067118e5f6368926a16fb46c4b6643faa2ca3beb82f733
SHA512d540026c28cf0f023d7acbaf4ba61780397c7886c605d8593e4cce43f58664b4db267320022a29557609397f1e141e097cf5e1727de4b426588decc134367576
-
Filesize
506KB
MD586ffad705f9567fbb7a19329a0fab39f
SHA16d9fc3a73aa7cd2c33d43f6e4cb1868840825e01
SHA256edce5f778dd3ecbbc1d5ff78cc2df5fad9abfb97056472d1f3bae65e5ee51b9d
SHA51299d640d37f7e01c242ef105e638b2ee8da8ad8188671ffa9c5e9deb99508d9c611ceb0e7a4807582f57ea58cd0e1ab3fbe58d241af9686c9d245ca8e882a822f
-
Filesize
506KB
MD586ffad705f9567fbb7a19329a0fab39f
SHA16d9fc3a73aa7cd2c33d43f6e4cb1868840825e01
SHA256edce5f778dd3ecbbc1d5ff78cc2df5fad9abfb97056472d1f3bae65e5ee51b9d
SHA51299d640d37f7e01c242ef105e638b2ee8da8ad8188671ffa9c5e9deb99508d9c611ceb0e7a4807582f57ea58cd0e1ab3fbe58d241af9686c9d245ca8e882a822f
-
Filesize
320KB
MD52b737fbd13a0a2c2118564809ff1ff2d
SHA186c8313e6da45da6daa14dfd882e1e4647317922
SHA2565c23647d4d472ef5e97366b81010feb6b5b99542595f9896e0e90b71e8123f62
SHA512188d99abdc74ece5be2e63d9a0dfdae7f92e19deb73c1f575f2ae55296ed4f780d4164420264d476f74f44c9647c0f7618857d5c338cdadb2c43b30334d8c803
-
Filesize
320KB
MD52b737fbd13a0a2c2118564809ff1ff2d
SHA186c8313e6da45da6daa14dfd882e1e4647317922
SHA2565c23647d4d472ef5e97366b81010feb6b5b99542595f9896e0e90b71e8123f62
SHA512188d99abdc74ece5be2e63d9a0dfdae7f92e19deb73c1f575f2ae55296ed4f780d4164420264d476f74f44c9647c0f7618857d5c338cdadb2c43b30334d8c803
-
Filesize
236KB
MD533e2e31ddbefefe21f8f0ba4282b4e76
SHA1b2336768bdb1aeb6e6cdf7485a39700df283afa8
SHA2564370891af82066afd6680405e80f26bdac7c995347826a0de8f4db786c9de30a
SHA512c09be23411e7b587486833792f27ec724501cc80492ac48acd18bcf2338fe11539deec14381ed5c7bfcd79ca726cf53d61648299a79d5e962c93da135b45e43f
-
Filesize
236KB
MD533e2e31ddbefefe21f8f0ba4282b4e76
SHA1b2336768bdb1aeb6e6cdf7485a39700df283afa8
SHA2564370891af82066afd6680405e80f26bdac7c995347826a0de8f4db786c9de30a
SHA512c09be23411e7b587486833792f27ec724501cc80492ac48acd18bcf2338fe11539deec14381ed5c7bfcd79ca726cf53d61648299a79d5e962c93da135b45e43f
-
Filesize
174KB
MD58ae453d4495cafd97fab29261424878d
SHA17d3adc3451ae912ff4620e3d5e94ff36f373b3a1
SHA256c7bc1d74dec2c272cb8000b8d0b92c1c0b03e3f11a00d08bbe56b8b16f25722f
SHA512ce2db66b646808585ab07044d549a8c1ff22c86281bb8c54befd0d6ecb62fe635579a0d3432191a620a18157095e1bb85c0cbb5858802f23c66c6044edf9aaf1
-
Filesize
174KB
MD58ae453d4495cafd97fab29261424878d
SHA17d3adc3451ae912ff4620e3d5e94ff36f373b3a1
SHA256c7bc1d74dec2c272cb8000b8d0b92c1c0b03e3f11a00d08bbe56b8b16f25722f
SHA512ce2db66b646808585ab07044d549a8c1ff22c86281bb8c54befd0d6ecb62fe635579a0d3432191a620a18157095e1bb85c0cbb5858802f23c66c6044edf9aaf1