Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    280s
  • max time network
    294s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22/10/2023, 22:18

General

  • Target

    1b3965a832f82cd3387c49ff87394ce8bceb3ac922ecbbb20155cac9aae014b4.exe

  • Size

    1.1MB

  • MD5

    726211d761490028db412b94f41560cd

  • SHA1

    35e2eaa4aef889f7ed15ba77c7a06790e983a507

  • SHA256

    1b3965a832f82cd3387c49ff87394ce8bceb3ac922ecbbb20155cac9aae014b4

  • SHA512

    290d47a1f42171474266fb2626ee9b0b02a81d337ccdbfd74355fe86c089fe4d8b63f7b804fe16ed0fed5ac27dcec2460ca13e91b252a399509d04bdd5da8abc

  • SSDEEP

    24576:ey95/7BePPX9rVOgu6sz8O2K8UZhPfZnrwdidLlhl+2fYe:t9VEP1xOLP6SPWEHlTf

Malware Config

Extracted

Family

redline

Botnet

kukish

C2

77.91.124.55:19071

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b3965a832f82cd3387c49ff87394ce8bceb3ac922ecbbb20155cac9aae014b4.exe
    "C:\Users\Admin\AppData\Local\Temp\1b3965a832f82cd3387c49ff87394ce8bceb3ac922ecbbb20155cac9aae014b4.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rs9Pc2fH.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rs9Pc2fH.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2132
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eR5fv0Ub.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eR5fv0Ub.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2268
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oG1hS0CJ.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oG1hS0CJ.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2668
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Go0AG3VT.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Go0AG3VT.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2524
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:2804
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 268
                  8⤵
                  • Program crash
                  PID:2520
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ns475Vf.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ns475Vf.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rs9Pc2fH.exe

    Filesize

    1.0MB

    MD5

    3ffce82243bf0fa7a1cb87b066e33f2f

    SHA1

    9f19000b6406bc3a27f382bf643d5c40333c2828

    SHA256

    95781c67818a759372fb2e8544fd6bbef027c8577b3aab2775ebd7dc5aa997da

    SHA512

    7952f20c0c3f63db738c79c17c280dbe95c0c46b072b043b5320e89344c99332ca05aa0ea6064d6fb5965998541c215412748aaec25beb19ff28f774c6bae6b3

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rs9Pc2fH.exe

    Filesize

    1.0MB

    MD5

    3ffce82243bf0fa7a1cb87b066e33f2f

    SHA1

    9f19000b6406bc3a27f382bf643d5c40333c2828

    SHA256

    95781c67818a759372fb2e8544fd6bbef027c8577b3aab2775ebd7dc5aa997da

    SHA512

    7952f20c0c3f63db738c79c17c280dbe95c0c46b072b043b5320e89344c99332ca05aa0ea6064d6fb5965998541c215412748aaec25beb19ff28f774c6bae6b3

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eR5fv0Ub.exe

    Filesize

    843KB

    MD5

    05469b49b0091b2b9ef6330c14f152b1

    SHA1

    fa66d88036b3e1b2435af9569be4f6ef862edac8

    SHA256

    66d8ae38cfd8313488b09350fb8d3ef264afe4fad378d114e9f2895a7057cbfc

    SHA512

    225ad4cf527d947e200023710f02360ffc3d1b4582c97c4a3aef1ddd45513822a4d56b1ddace639535d9301b7ebf6ba3c570dc01436feaf71b79e2e1a7d75c1f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eR5fv0Ub.exe

    Filesize

    843KB

    MD5

    05469b49b0091b2b9ef6330c14f152b1

    SHA1

    fa66d88036b3e1b2435af9569be4f6ef862edac8

    SHA256

    66d8ae38cfd8313488b09350fb8d3ef264afe4fad378d114e9f2895a7057cbfc

    SHA512

    225ad4cf527d947e200023710f02360ffc3d1b4582c97c4a3aef1ddd45513822a4d56b1ddace639535d9301b7ebf6ba3c570dc01436feaf71b79e2e1a7d75c1f

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oG1hS0CJ.exe

    Filesize

    593KB

    MD5

    5fcf4905afd88c3331bdeef226bcf1e3

    SHA1

    526c7c6c4f03098e64668218c36232f357555a36

    SHA256

    f4e71298168165ee46550537696fb2618c82fe702591c1a78fd0c320c397e853

    SHA512

    92fed6a808f8917f5015227aa411d7ee72be1a63120d06465b8b7a8535e74769799f128959a64c937b70e727c38e1566f4d5e54aed8d7c115d14f1b51765e4a8

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\oG1hS0CJ.exe

    Filesize

    593KB

    MD5

    5fcf4905afd88c3331bdeef226bcf1e3

    SHA1

    526c7c6c4f03098e64668218c36232f357555a36

    SHA256

    f4e71298168165ee46550537696fb2618c82fe702591c1a78fd0c320c397e853

    SHA512

    92fed6a808f8917f5015227aa411d7ee72be1a63120d06465b8b7a8535e74769799f128959a64c937b70e727c38e1566f4d5e54aed8d7c115d14f1b51765e4a8

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Go0AG3VT.exe

    Filesize

    398KB

    MD5

    82b8ef7dc3016639519f61dab53fd45c

    SHA1

    72a48d09ddf862aa9fe876d999df45973c994ac1

    SHA256

    602ba5059b5ab005f43b419684ae2ebdde93abca409fb458a0fdb8675fbeb050

    SHA512

    5b30476707bdc657c4a2c36a8f098c143a8cea9250b6faff4d5495d726111ae4bbcac46f992e55b8cd1fdb690972dbad8df37655ba58eb29ca380d728e1defcf

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Go0AG3VT.exe

    Filesize

    398KB

    MD5

    82b8ef7dc3016639519f61dab53fd45c

    SHA1

    72a48d09ddf862aa9fe876d999df45973c994ac1

    SHA256

    602ba5059b5ab005f43b419684ae2ebdde93abca409fb458a0fdb8675fbeb050

    SHA512

    5b30476707bdc657c4a2c36a8f098c143a8cea9250b6faff4d5495d726111ae4bbcac46f992e55b8cd1fdb690972dbad8df37655ba58eb29ca380d728e1defcf

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe

    Filesize

    320KB

    MD5

    e941da6fe6a36a6e4c84d19a15d99743

    SHA1

    d557bd482ed220d9f1f6b06ec3791ad9d41af036

    SHA256

    6f955c6d0db18df11a8c1797208beb949eb30b5bd0443f7adb9731615b368aa8

    SHA512

    45a973c191368cc56f6ff79a235ad7103f54df6a5d32ee7d11d4e3346af1cc60996caa1c6e94a4fa21789ad9f7ee57a82dde607455ca8fb48407c60cbd023920

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe

    Filesize

    320KB

    MD5

    e941da6fe6a36a6e4c84d19a15d99743

    SHA1

    d557bd482ed220d9f1f6b06ec3791ad9d41af036

    SHA256

    6f955c6d0db18df11a8c1797208beb949eb30b5bd0443f7adb9731615b368aa8

    SHA512

    45a973c191368cc56f6ff79a235ad7103f54df6a5d32ee7d11d4e3346af1cc60996caa1c6e94a4fa21789ad9f7ee57a82dde607455ca8fb48407c60cbd023920

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe

    Filesize

    320KB

    MD5

    e941da6fe6a36a6e4c84d19a15d99743

    SHA1

    d557bd482ed220d9f1f6b06ec3791ad9d41af036

    SHA256

    6f955c6d0db18df11a8c1797208beb949eb30b5bd0443f7adb9731615b368aa8

    SHA512

    45a973c191368cc56f6ff79a235ad7103f54df6a5d32ee7d11d4e3346af1cc60996caa1c6e94a4fa21789ad9f7ee57a82dde607455ca8fb48407c60cbd023920

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ns475Vf.exe

    Filesize

    222KB

    MD5

    d630dd384dd7df38ecaf9e878432343b

    SHA1

    9f39065c4cc8e7d7c0890011e1b8a059551e8236

    SHA256

    2946cf3bff46d9cd413962bf01d5d440bfc5624bfef33b626349d8e3751c4f02

    SHA512

    d207b77d2c24f958a87948c9b24f000e86adff94b6c526ba3813661eb85fa8e75ff867602e0106c807770efd93a764f35a0a604bac05fb5000683dc2e213c4ba

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ns475Vf.exe

    Filesize

    222KB

    MD5

    d630dd384dd7df38ecaf9e878432343b

    SHA1

    9f39065c4cc8e7d7c0890011e1b8a059551e8236

    SHA256

    2946cf3bff46d9cd413962bf01d5d440bfc5624bfef33b626349d8e3751c4f02

    SHA512

    d207b77d2c24f958a87948c9b24f000e86adff94b6c526ba3813661eb85fa8e75ff867602e0106c807770efd93a764f35a0a604bac05fb5000683dc2e213c4ba

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Rs9Pc2fH.exe

    Filesize

    1.0MB

    MD5

    3ffce82243bf0fa7a1cb87b066e33f2f

    SHA1

    9f19000b6406bc3a27f382bf643d5c40333c2828

    SHA256

    95781c67818a759372fb2e8544fd6bbef027c8577b3aab2775ebd7dc5aa997da

    SHA512

    7952f20c0c3f63db738c79c17c280dbe95c0c46b072b043b5320e89344c99332ca05aa0ea6064d6fb5965998541c215412748aaec25beb19ff28f774c6bae6b3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Rs9Pc2fH.exe

    Filesize

    1.0MB

    MD5

    3ffce82243bf0fa7a1cb87b066e33f2f

    SHA1

    9f19000b6406bc3a27f382bf643d5c40333c2828

    SHA256

    95781c67818a759372fb2e8544fd6bbef027c8577b3aab2775ebd7dc5aa997da

    SHA512

    7952f20c0c3f63db738c79c17c280dbe95c0c46b072b043b5320e89344c99332ca05aa0ea6064d6fb5965998541c215412748aaec25beb19ff28f774c6bae6b3

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\eR5fv0Ub.exe

    Filesize

    843KB

    MD5

    05469b49b0091b2b9ef6330c14f152b1

    SHA1

    fa66d88036b3e1b2435af9569be4f6ef862edac8

    SHA256

    66d8ae38cfd8313488b09350fb8d3ef264afe4fad378d114e9f2895a7057cbfc

    SHA512

    225ad4cf527d947e200023710f02360ffc3d1b4582c97c4a3aef1ddd45513822a4d56b1ddace639535d9301b7ebf6ba3c570dc01436feaf71b79e2e1a7d75c1f

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\eR5fv0Ub.exe

    Filesize

    843KB

    MD5

    05469b49b0091b2b9ef6330c14f152b1

    SHA1

    fa66d88036b3e1b2435af9569be4f6ef862edac8

    SHA256

    66d8ae38cfd8313488b09350fb8d3ef264afe4fad378d114e9f2895a7057cbfc

    SHA512

    225ad4cf527d947e200023710f02360ffc3d1b4582c97c4a3aef1ddd45513822a4d56b1ddace639535d9301b7ebf6ba3c570dc01436feaf71b79e2e1a7d75c1f

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\oG1hS0CJ.exe

    Filesize

    593KB

    MD5

    5fcf4905afd88c3331bdeef226bcf1e3

    SHA1

    526c7c6c4f03098e64668218c36232f357555a36

    SHA256

    f4e71298168165ee46550537696fb2618c82fe702591c1a78fd0c320c397e853

    SHA512

    92fed6a808f8917f5015227aa411d7ee72be1a63120d06465b8b7a8535e74769799f128959a64c937b70e727c38e1566f4d5e54aed8d7c115d14f1b51765e4a8

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\oG1hS0CJ.exe

    Filesize

    593KB

    MD5

    5fcf4905afd88c3331bdeef226bcf1e3

    SHA1

    526c7c6c4f03098e64668218c36232f357555a36

    SHA256

    f4e71298168165ee46550537696fb2618c82fe702591c1a78fd0c320c397e853

    SHA512

    92fed6a808f8917f5015227aa411d7ee72be1a63120d06465b8b7a8535e74769799f128959a64c937b70e727c38e1566f4d5e54aed8d7c115d14f1b51765e4a8

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\Go0AG3VT.exe

    Filesize

    398KB

    MD5

    82b8ef7dc3016639519f61dab53fd45c

    SHA1

    72a48d09ddf862aa9fe876d999df45973c994ac1

    SHA256

    602ba5059b5ab005f43b419684ae2ebdde93abca409fb458a0fdb8675fbeb050

    SHA512

    5b30476707bdc657c4a2c36a8f098c143a8cea9250b6faff4d5495d726111ae4bbcac46f992e55b8cd1fdb690972dbad8df37655ba58eb29ca380d728e1defcf

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\Go0AG3VT.exe

    Filesize

    398KB

    MD5

    82b8ef7dc3016639519f61dab53fd45c

    SHA1

    72a48d09ddf862aa9fe876d999df45973c994ac1

    SHA256

    602ba5059b5ab005f43b419684ae2ebdde93abca409fb458a0fdb8675fbeb050

    SHA512

    5b30476707bdc657c4a2c36a8f098c143a8cea9250b6faff4d5495d726111ae4bbcac46f992e55b8cd1fdb690972dbad8df37655ba58eb29ca380d728e1defcf

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe

    Filesize

    320KB

    MD5

    e941da6fe6a36a6e4c84d19a15d99743

    SHA1

    d557bd482ed220d9f1f6b06ec3791ad9d41af036

    SHA256

    6f955c6d0db18df11a8c1797208beb949eb30b5bd0443f7adb9731615b368aa8

    SHA512

    45a973c191368cc56f6ff79a235ad7103f54df6a5d32ee7d11d4e3346af1cc60996caa1c6e94a4fa21789ad9f7ee57a82dde607455ca8fb48407c60cbd023920

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe

    Filesize

    320KB

    MD5

    e941da6fe6a36a6e4c84d19a15d99743

    SHA1

    d557bd482ed220d9f1f6b06ec3791ad9d41af036

    SHA256

    6f955c6d0db18df11a8c1797208beb949eb30b5bd0443f7adb9731615b368aa8

    SHA512

    45a973c191368cc56f6ff79a235ad7103f54df6a5d32ee7d11d4e3346af1cc60996caa1c6e94a4fa21789ad9f7ee57a82dde607455ca8fb48407c60cbd023920

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1AE46Yf6.exe

    Filesize

    320KB

    MD5

    e941da6fe6a36a6e4c84d19a15d99743

    SHA1

    d557bd482ed220d9f1f6b06ec3791ad9d41af036

    SHA256

    6f955c6d0db18df11a8c1797208beb949eb30b5bd0443f7adb9731615b368aa8

    SHA512

    45a973c191368cc56f6ff79a235ad7103f54df6a5d32ee7d11d4e3346af1cc60996caa1c6e94a4fa21789ad9f7ee57a82dde607455ca8fb48407c60cbd023920

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\2ns475Vf.exe

    Filesize

    222KB

    MD5

    d630dd384dd7df38ecaf9e878432343b

    SHA1

    9f39065c4cc8e7d7c0890011e1b8a059551e8236

    SHA256

    2946cf3bff46d9cd413962bf01d5d440bfc5624bfef33b626349d8e3751c4f02

    SHA512

    d207b77d2c24f958a87948c9b24f000e86adff94b6c526ba3813661eb85fa8e75ff867602e0106c807770efd93a764f35a0a604bac05fb5000683dc2e213c4ba

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\2ns475Vf.exe

    Filesize

    222KB

    MD5

    d630dd384dd7df38ecaf9e878432343b

    SHA1

    9f39065c4cc8e7d7c0890011e1b8a059551e8236

    SHA256

    2946cf3bff46d9cd413962bf01d5d440bfc5624bfef33b626349d8e3751c4f02

    SHA512

    d207b77d2c24f958a87948c9b24f000e86adff94b6c526ba3813661eb85fa8e75ff867602e0106c807770efd93a764f35a0a604bac05fb5000683dc2e213c4ba

  • memory/2564-71-0x0000000000AD0000-0x0000000000B0E000-memory.dmp

    Filesize

    248KB

  • memory/2804-56-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-58-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2804-57-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-60-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-55-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-66-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-53-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-62-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB

  • memory/2804-54-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB