Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 04:02

General

  • Target

    dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f.exe

  • Size

    937KB

  • MD5

    5466d6e8f7e190b0db624958b4844b7c

  • SHA1

    e576c4888e5a290f3aa33316000a38cfb92e94b2

  • SHA256

    dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f

  • SHA512

    0406528fe4370dc8de9cf6ac81f46376542470a14d36154ac3e387325bca14043481e7998f241162ae2b63c7dcc872052d5ffbaf8cb03c399b6e8efa6fb4e36e

  • SSDEEP

    24576:LybIieayuBpxxQ5UhhimHTY/9BGL5IBNUL+Pi5MSEbC9HnHE8k:+buMrxlhZHs/iL5IBNhPEu2

Malware Config

Extracted

Family

redline

Botnet

tuxiu

C2

77.91.124.82:19071

Attributes
  • auth_value

    29610cdad07e7187eec70685a04b89fe

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f.exe
    "C:\Users\Admin\AppData\Local\Temp\dc6d5bd8f0c5781801301c209a03004c1d7309335238355bcc31c5ad5f3ae83f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4296
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3732
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4892
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:1668
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 540
                  7⤵
                  • Program crash
                  PID:1288
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 556
                6⤵
                • Program crash
                PID:5004
            • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2716118.exe
              C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2716118.exe
              5⤵
              • Executes dropped EXE
              PID:1832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4892 -ip 4892
      1⤵
        PID:4792
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1668 -ip 1668
        1⤵
          PID:4640

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe

          Filesize

          836KB

          MD5

          de825d1dd2075e37acd6d65d78b2b3cf

          SHA1

          841cbfd6470eda445b82056e6b0325949a388dfa

          SHA256

          32297758761cd491cf8fe2a198d277f4fd844ebb1e2867d7b025c9085513dc9f

          SHA512

          12768a8e11eab3108bc5dbf5c96b8b291f8a0f1f2b61787fce25161b0998010afc0aae15d302fe385dd5d043ac350f1502d20e9ebf6ba95ea75268417e3f1413

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6313644.exe

          Filesize

          836KB

          MD5

          de825d1dd2075e37acd6d65d78b2b3cf

          SHA1

          841cbfd6470eda445b82056e6b0325949a388dfa

          SHA256

          32297758761cd491cf8fe2a198d277f4fd844ebb1e2867d7b025c9085513dc9f

          SHA512

          12768a8e11eab3108bc5dbf5c96b8b291f8a0f1f2b61787fce25161b0998010afc0aae15d302fe385dd5d043ac350f1502d20e9ebf6ba95ea75268417e3f1413

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe

          Filesize

          571KB

          MD5

          c3c0ecc8ef0cebe910c75b4452999cba

          SHA1

          7269cd2ba945159955e542c94f1b2dd9ba06650f

          SHA256

          1dbed4c0b9a383e4c8a944b4a6a04f1a3e1042c7b590fd05c42e0cb67acdd264

          SHA512

          09791bb8d270ecdcbdd1b4b2ab45f711cccd2d1035a30efb82df4b69749d63439213043ecad251946ea2ee2ba41eac29bdb771d8ca8cf03e9361a18254e71813

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0728934.exe

          Filesize

          571KB

          MD5

          c3c0ecc8ef0cebe910c75b4452999cba

          SHA1

          7269cd2ba945159955e542c94f1b2dd9ba06650f

          SHA256

          1dbed4c0b9a383e4c8a944b4a6a04f1a3e1042c7b590fd05c42e0cb67acdd264

          SHA512

          09791bb8d270ecdcbdd1b4b2ab45f711cccd2d1035a30efb82df4b69749d63439213043ecad251946ea2ee2ba41eac29bdb771d8ca8cf03e9361a18254e71813

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe

          Filesize

          394KB

          MD5

          40b9226a7da2e7b42b051cfd8b0cc5be

          SHA1

          3e68d73e14696acb245a233472797a8aec8aa7c2

          SHA256

          258df03e7af46a9bdb068ebabdea47cb8e9797ab23863470495890f9f036fa25

          SHA512

          f391c913f73dfe092cde125c7283f6f9d64d61056dc34badc00eca1896379631adc40884cc82c0a547f1b060fd86ef56aae04c87fe7d0be93472db400dbc0cd0

        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0865767.exe

          Filesize

          394KB

          MD5

          40b9226a7da2e7b42b051cfd8b0cc5be

          SHA1

          3e68d73e14696acb245a233472797a8aec8aa7c2

          SHA256

          258df03e7af46a9bdb068ebabdea47cb8e9797ab23863470495890f9f036fa25

          SHA512

          f391c913f73dfe092cde125c7283f6f9d64d61056dc34badc00eca1896379631adc40884cc82c0a547f1b060fd86ef56aae04c87fe7d0be93472db400dbc0cd0

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

          Filesize

          365KB

          MD5

          01c404e834818ca8eabe9fe6c322cd4a

          SHA1

          7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

          SHA256

          2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

          SHA512

          1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7262670.exe

          Filesize

          365KB

          MD5

          01c404e834818ca8eabe9fe6c322cd4a

          SHA1

          7b7676e08cfbb3c93c4ca5d742ae9da1db929d55

          SHA256

          2fa0939efd5437f0151cca497890dcaee3f4dce2568edbe5bb2483ce0116e105

          SHA512

          1d0a9142a448f2db5aeef44e5a084169677bc71fd3c5996b19090a87d6de493493def6507e81760d27c045a8f71476ae10d78e2b77433040ad09165fb502af7a

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2716118.exe

          Filesize

          174KB

          MD5

          2176a84304b74fb5ecca37c2c88b9e04

          SHA1

          f0b42493e0da6f3c04ad2e529780058a5226836e

          SHA256

          ca9993f60db0e0d2db02204db002d5e815b0e380a558d04a99bcbb2149a9a9d6

          SHA512

          ccf51a393036e44575190b9119b74bdb5d156a9fc9c74bc8b214b776d27988e3fda086557796dfc055855104541b40965f597a3197dc818e4d3bc5a81220692a

        • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2716118.exe

          Filesize

          174KB

          MD5

          2176a84304b74fb5ecca37c2c88b9e04

          SHA1

          f0b42493e0da6f3c04ad2e529780058a5226836e

          SHA256

          ca9993f60db0e0d2db02204db002d5e815b0e380a558d04a99bcbb2149a9a9d6

          SHA512

          ccf51a393036e44575190b9119b74bdb5d156a9fc9c74bc8b214b776d27988e3fda086557796dfc055855104541b40965f597a3197dc818e4d3bc5a81220692a

        • memory/1668-30-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/1668-29-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/1668-32-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/1668-28-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

        • memory/1832-39-0x000000000ABD0000-0x000000000B1E8000-memory.dmp

          Filesize

          6.1MB

        • memory/1832-37-0x0000000074360000-0x0000000074B10000-memory.dmp

          Filesize

          7.7MB

        • memory/1832-38-0x00000000051D0000-0x00000000051D6000-memory.dmp

          Filesize

          24KB

        • memory/1832-36-0x00000000008B0000-0x00000000008E0000-memory.dmp

          Filesize

          192KB

        • memory/1832-40-0x0000000074360000-0x0000000074B10000-memory.dmp

          Filesize

          7.7MB

        • memory/1832-41-0x000000000A720000-0x000000000A82A000-memory.dmp

          Filesize

          1.0MB

        • memory/1832-43-0x000000000A660000-0x000000000A672000-memory.dmp

          Filesize

          72KB

        • memory/1832-42-0x0000000005220000-0x0000000005230000-memory.dmp

          Filesize

          64KB

        • memory/1832-44-0x000000000A6C0000-0x000000000A6FC000-memory.dmp

          Filesize

          240KB

        • memory/1832-45-0x0000000005100000-0x000000000514C000-memory.dmp

          Filesize

          304KB

        • memory/1832-46-0x0000000005220000-0x0000000005230000-memory.dmp

          Filesize

          64KB