Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    225s
  • max time network
    297s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    12/02/2024, 04:56

General

  • Target

    5f308a9da30dbe668bd1e2e2f7067e8812d67f14703d4b24c47412bfe23f4a8b.exe

  • Size

    473KB

  • MD5

    abfcb597aba704faa71413f1c113981d

  • SHA1

    823fc94f17e7981098f15ebcc05b6decc3faf716

  • SHA256

    5f308a9da30dbe668bd1e2e2f7067e8812d67f14703d4b24c47412bfe23f4a8b

  • SHA512

    899001c907d25acd0fb47457b7ea6366831de5c052ef69635cb8ff391289fdf16074c1e9ebbd770f93877eb904a4bf481f28442f69a96bebc10fcbb00d85b2ec

  • SSDEEP

    6144:7DKW1Lgbdl0TBBvjc/CoMKypduBiXa3p5+jDgYHHRo5z9KtmDaimb/u10FcC+FYg:Ph1Lk70TnvjceK+q3p58DnRuzLAAF/BZ

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Telegram: @logsdillabot)

C2

5.42.65.38:46185

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • XMRig Miner payload 17 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 22 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5f308a9da30dbe668bd1e2e2f7067e8812d67f14703d4b24c47412bfe23f4a8b.exe
    "C:\Users\Admin\AppData\Local\Temp\5f308a9da30dbe668bd1e2e2f7067e8812d67f14703d4b24c47412bfe23f4a8b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4040
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:3636
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:916
        • C:\Users\Admin\AppData\Local\Temp\filename.exe
          "C:\Users\Admin\AppData\Local\Temp\filename.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Drops file in Drivers directory
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:3320
          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4136
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop UsoSvc
            4⤵
            • Launches sc.exe
            PID:3792
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1804
            • C:\Windows\system32\wusa.exe
              wusa /uninstall /kb:890830 /quiet /norestart
              5⤵
                PID:2808
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop WaaSMedicSvc
              4⤵
              • Launches sc.exe
              PID:2800
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop wuauserv
              4⤵
              • Launches sc.exe
              PID:3644
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop bits
              4⤵
              • Launches sc.exe
              PID:5020
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop dosvc
              4⤵
              • Launches sc.exe
              PID:2284
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1876
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2096
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2108
            • C:\Windows\system32\powercfg.exe
              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3684
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
              4⤵
              • Launches sc.exe
              PID:5004
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
              4⤵
              • Launches sc.exe
              PID:4348
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
              4⤵
              • Launches sc.exe
              PID:920
            • C:\Windows\system32\sc.exe
              C:\Windows\system32\sc.exe stop eventlog
              4⤵
              • Launches sc.exe
              PID:1924
      • C:\ProgramData\Google\Chrome\updater.exe
        C:\ProgramData\Google\Chrome\updater.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Drops file in Drivers directory
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3528
        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          2⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3088
        • C:\Windows\system32\sc.exe
          C:\Windows\system32\sc.exe stop UsoSvc
          2⤵
          • Launches sc.exe
          PID:1800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4720
          • C:\Windows\system32\wusa.exe
            wusa /uninstall /kb:890830 /quiet /norestart
            3⤵
              PID:1200
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop WaaSMedicSvc
            2⤵
            • Launches sc.exe
            PID:1596
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop wuauserv
            2⤵
            • Launches sc.exe
            PID:4804
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop bits
            2⤵
            • Launches sc.exe
            PID:4704
          • C:\Windows\system32\sc.exe
            C:\Windows\system32\sc.exe stop dosvc
            2⤵
            • Launches sc.exe
            PID:164
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3768
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4420
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4204
          • C:\Windows\system32\powercfg.exe
            C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:316
          • C:\Windows\system32\conhost.exe
            C:\Windows\system32\conhost.exe
            2⤵
              PID:3644
            • C:\Windows\explorer.exe
              explorer.exe
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4808

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hv5taj3w.4ut.ps1

            Filesize

            1B

            MD5

            c4ca4238a0b923820dcc509a6f75849b

            SHA1

            356a192b7913b04c54574d18c28d46e6395428ab

            SHA256

            6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

            SHA512

            4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

          • C:\Users\Admin\AppData\Local\Temp\filename.exe

            Filesize

            7.9MB

            MD5

            c7360f031893f764c09c12d1a93bb6b3

            SHA1

            ed7645fce92872be3668dd38da104ec0c5648213

            SHA256

            3c1b63ce143c1979f3d963fd3ed0d838bc231c1d2fcb02a965c7230ef94dc899

            SHA512

            6924d9f34c317bd45008446bef35a4ef9da1f985cc213ad32d29d5f1dceaef0b3f73b07eec6d489e561711ff6cbb7e99ea110d345d89f571ad3ca4852381f413

          • C:\Windows\system32\drivers\etc\hosts

            Filesize

            3KB

            MD5

            2d29fd3ae57f422e2b2121141dc82253

            SHA1

            c2464c857779c0ab4f5e766f5028fcc651a6c6b7

            SHA256

            80a60d7ec533d820de20bcedeb41319e7b1def548b6ea73ddbd69455bac4e7a4

            SHA512

            077a5c554663be7b71f181d961f5c98c732bc296dc015ffee30768a648bee3aad62c39c352cf2947432be19519906aeac7dfaf2557d309bb460732abb7fdbc68

          • memory/916-20-0x0000000005520000-0x0000000005532000-memory.dmp

            Filesize

            72KB

          • memory/916-24-0x0000000006D10000-0x0000000006ED2000-memory.dmp

            Filesize

            1.8MB

          • memory/916-33-0x0000000073F40000-0x000000007462E000-memory.dmp

            Filesize

            6.9MB

          • memory/916-26-0x00000000071E0000-0x0000000007230000-memory.dmp

            Filesize

            320KB

          • memory/916-25-0x0000000007410000-0x000000000793C000-memory.dmp

            Filesize

            5.2MB

          • memory/916-10-0x0000000000400000-0x0000000000454000-memory.dmp

            Filesize

            336KB

          • memory/916-22-0x0000000005700000-0x000000000574B000-memory.dmp

            Filesize

            300KB

          • memory/916-15-0x0000000073F40000-0x000000007462E000-memory.dmp

            Filesize

            6.9MB

          • memory/916-23-0x0000000005E80000-0x0000000005EE6000-memory.dmp

            Filesize

            408KB

          • memory/916-16-0x00000000052E0000-0x0000000005372000-memory.dmp

            Filesize

            584KB

          • memory/916-17-0x00000000051C0000-0x00000000051CA000-memory.dmp

            Filesize

            40KB

          • memory/916-18-0x00000000062F0000-0x00000000068F6000-memory.dmp

            Filesize

            6.0MB

          • memory/916-19-0x00000000055F0000-0x00000000056FA000-memory.dmp

            Filesize

            1.0MB

          • memory/916-21-0x0000000005580000-0x00000000055BE000-memory.dmp

            Filesize

            248KB

          • memory/3088-107-0x0000022B4B900000-0x0000022B4B910000-memory.dmp

            Filesize

            64KB

          • memory/3088-225-0x0000022B4B900000-0x0000022B4B910000-memory.dmp

            Filesize

            64KB

          • memory/3088-105-0x00007FFEF5DD0000-0x00007FFEF67BC000-memory.dmp

            Filesize

            9.9MB

          • memory/3088-127-0x0000022B4B8C0000-0x0000022B4B8DC000-memory.dmp

            Filesize

            112KB

          • memory/3088-128-0x00007FF67A880000-0x00007FF67A890000-memory.dmp

            Filesize

            64KB

          • memory/3088-134-0x0000022B4BD10000-0x0000022B4BDC9000-memory.dmp

            Filesize

            740KB

          • memory/3088-258-0x00007FFEF5DD0000-0x00007FFEF67BC000-memory.dmp

            Filesize

            9.9MB

          • memory/3088-224-0x0000022B4B900000-0x0000022B4B910000-memory.dmp

            Filesize

            64KB

          • memory/3088-167-0x0000022B4B8E0000-0x0000022B4B8EA000-memory.dmp

            Filesize

            40KB

          • memory/3088-108-0x0000022B4B900000-0x0000022B4B910000-memory.dmp

            Filesize

            64KB

          • memory/3320-36-0x00007FFF026C0000-0x00007FFF0289B000-memory.dmp

            Filesize

            1.9MB

          • memory/3320-37-0x00007FF6E8C10000-0x00007FF6E9963000-memory.dmp

            Filesize

            13.3MB

          • memory/3320-38-0x00007FF6E8C10000-0x00007FF6E9963000-memory.dmp

            Filesize

            13.3MB

          • memory/3320-39-0x00007FF6E8C10000-0x00007FF6E9963000-memory.dmp

            Filesize

            13.3MB

          • memory/3320-34-0x00007FF6E8C10000-0x00007FF6E9963000-memory.dmp

            Filesize

            13.3MB

          • memory/3320-35-0x00007FF6E8C10000-0x00007FF6E9963000-memory.dmp

            Filesize

            13.3MB

          • memory/3320-94-0x00007FFF026C0000-0x00007FFF0289B000-memory.dmp

            Filesize

            1.9MB

          • memory/3320-93-0x00007FF6E8C10000-0x00007FF6E9963000-memory.dmp

            Filesize

            13.3MB

          • memory/3528-98-0x00007FF6CCA30000-0x00007FF6CD783000-memory.dmp

            Filesize

            13.3MB

          • memory/3528-275-0x00007FFF026C0000-0x00007FFF0289B000-memory.dmp

            Filesize

            1.9MB

          • memory/3528-273-0x00007FF6CCA30000-0x00007FF6CD783000-memory.dmp

            Filesize

            13.3MB

          • memory/3528-97-0x00007FF6CCA30000-0x00007FF6CD783000-memory.dmp

            Filesize

            13.3MB

          • memory/3528-99-0x00007FFF026C0000-0x00007FFF0289B000-memory.dmp

            Filesize

            1.9MB

          • memory/3528-100-0x00007FF6CCA30000-0x00007FF6CD783000-memory.dmp

            Filesize

            13.3MB

          • memory/3528-101-0x00007FF6CCA30000-0x00007FF6CD783000-memory.dmp

            Filesize

            13.3MB

          • memory/3644-261-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/3644-264-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/3644-265-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/3644-268-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/3644-263-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/3644-262-0x0000000140000000-0x000000014000E000-memory.dmp

            Filesize

            56KB

          • memory/4040-12-0x0000000002600000-0x0000000004600000-memory.dmp

            Filesize

            32.0MB

          • memory/4040-1-0x0000000073F40000-0x000000007462E000-memory.dmp

            Filesize

            6.9MB

          • memory/4040-14-0x0000000073F40000-0x000000007462E000-memory.dmp

            Filesize

            6.9MB

          • memory/4040-7-0x00000000023D0000-0x00000000023E0000-memory.dmp

            Filesize

            64KB

          • memory/4040-6-0x0000000002470000-0x00000000024CA000-memory.dmp

            Filesize

            360KB

          • memory/4040-5-0x0000000004A40000-0x0000000004F3E000-memory.dmp

            Filesize

            5.0MB

          • memory/4040-4-0x00000000023D0000-0x00000000023E0000-memory.dmp

            Filesize

            64KB

          • memory/4040-3-0x00000000023D0000-0x00000000023E0000-memory.dmp

            Filesize

            64KB

          • memory/4040-2-0x00000000023D0000-0x00000000023E0000-memory.dmp

            Filesize

            64KB

          • memory/4040-0-0x0000000002410000-0x000000000246C000-memory.dmp

            Filesize

            368KB

          • memory/4136-44-0x00000186610E0000-0x0000018661102000-memory.dmp

            Filesize

            136KB

          • memory/4136-45-0x00007FFEF5DD0000-0x00007FFEF67BC000-memory.dmp

            Filesize

            9.9MB

          • memory/4136-86-0x0000018679640000-0x0000018679650000-memory.dmp

            Filesize

            64KB

          • memory/4136-46-0x0000018679640000-0x0000018679650000-memory.dmp

            Filesize

            64KB

          • memory/4136-47-0x0000018679640000-0x0000018679650000-memory.dmp

            Filesize

            64KB

          • memory/4136-90-0x00007FFEF5DD0000-0x00007FFEF67BC000-memory.dmp

            Filesize

            9.9MB

          • memory/4136-63-0x0000018679640000-0x0000018679650000-memory.dmp

            Filesize

            64KB

          • memory/4136-50-0x00000186797D0000-0x0000018679846000-memory.dmp

            Filesize

            472KB

          • memory/4808-274-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-282-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-271-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-270-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-269-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-276-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-277-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-278-0x0000000001150000-0x0000000001170000-memory.dmp

            Filesize

            128KB

          • memory/4808-279-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-280-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-281-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-272-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-283-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-284-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-285-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-286-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-287-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-288-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-289-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-290-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-291-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-292-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB

          • memory/4808-293-0x0000000140000000-0x0000000140848000-memory.dmp

            Filesize

            8.3MB