Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 18:27

General

  • Target

    cdc39c393e568869248dee077808c74a5d4bce8ddf68fce5d31d02e62a903ac0.exe

  • Size

    612KB

  • MD5

    612478b7e6630a65dc2944f79ae1ac70

  • SHA1

    c9acf440838a19c14fc7cc9146e76743c2b3174f

  • SHA256

    cdc39c393e568869248dee077808c74a5d4bce8ddf68fce5d31d02e62a903ac0

  • SHA512

    0d7fb6f06076d518b9169d52f9e9da2555e5e9ada903bd78b1c538e7951396888663e479dc86e2f08e42dbd4893fd55ceedbb620dd742b9030d02cab3230cde1

  • SSDEEP

    12288:Jy90EG+an4kf8cewJ2H3F1rsP3MqgShiIisYlKZ9VxU5:JylaD8xwJWG35hHijk/xU5

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdc39c393e568869248dee077808c74a5d4bce8ddf68fce5d31d02e62a903ac0.exe
    "C:\Users\Admin\AppData\Local\Temp\cdc39c393e568869248dee077808c74a5d4bce8ddf68fce5d31d02e62a903ac0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2784
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st542404.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st542404.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4896
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\46409418.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\46409418.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450499.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450499.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4776

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st542404.exe

    Filesize

    457KB

    MD5

    a0cae377e3a1f01302ef455ceee3f1bc

    SHA1

    afd7e064f121cf7a486242828a3c9b352dfddd5f

    SHA256

    aff3bbfb2cdad14c524bc2edc45c96c3b26d249e63b6a7acf589882634b2c660

    SHA512

    4280d0b7d5269c04710e9d2949f555c699b480aa2e7ff4eea804568f89e9b1d2d4bcbe26602b5d474fc3064c5d2ee5125266cc463cb0c2c2a5735afac3123860

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st542404.exe

    Filesize

    457KB

    MD5

    a0cae377e3a1f01302ef455ceee3f1bc

    SHA1

    afd7e064f121cf7a486242828a3c9b352dfddd5f

    SHA256

    aff3bbfb2cdad14c524bc2edc45c96c3b26d249e63b6a7acf589882634b2c660

    SHA512

    4280d0b7d5269c04710e9d2949f555c699b480aa2e7ff4eea804568f89e9b1d2d4bcbe26602b5d474fc3064c5d2ee5125266cc463cb0c2c2a5735afac3123860

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\46409418.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\46409418.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450499.exe

    Filesize

    459KB

    MD5

    a7142183c1fc3deaaf30ac4450f0cb56

    SHA1

    bb914446108e0dca8bb6bb8b7057ea27a5ecf931

    SHA256

    e644a8e3af4a5fbbf59475abc7a4c73bd90d11c4422327bd726d45320f603251

    SHA512

    40ef4a59e7c8de72e9f5777ade2751452ff6813682c7999b8bfddf50945af66409688684ff205bcf737a333efb958a6f764d31b159765124a15ef370629bf05f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp450499.exe

    Filesize

    459KB

    MD5

    a7142183c1fc3deaaf30ac4450f0cb56

    SHA1

    bb914446108e0dca8bb6bb8b7057ea27a5ecf931

    SHA256

    e644a8e3af4a5fbbf59475abc7a4c73bd90d11c4422327bd726d45320f603251

    SHA512

    40ef4a59e7c8de72e9f5777ade2751452ff6813682c7999b8bfddf50945af66409688684ff205bcf737a333efb958a6f764d31b159765124a15ef370629bf05f

  • memory/4560-147-0x0000000000C00000-0x0000000000C0A000-memory.dmp

    Filesize

    40KB

  • memory/4776-153-0x0000000000960000-0x00000000009A6000-memory.dmp

    Filesize

    280KB

  • memory/4776-154-0x0000000004F60000-0x0000000005504000-memory.dmp

    Filesize

    5.6MB

  • memory/4776-155-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-157-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-156-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-158-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-161-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-159-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-163-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-165-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-167-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-169-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-171-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-173-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-175-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-177-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-179-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-181-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-183-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-185-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-187-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-189-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-191-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-193-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-195-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-197-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-199-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-201-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-203-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-205-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-207-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-209-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-211-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-213-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-215-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-217-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-219-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-221-0x0000000002880000-0x00000000028B5000-memory.dmp

    Filesize

    212KB

  • memory/4776-950-0x0000000007990000-0x0000000007FA8000-memory.dmp

    Filesize

    6.1MB

  • memory/4776-951-0x0000000004F10000-0x0000000004F22000-memory.dmp

    Filesize

    72KB

  • memory/4776-952-0x0000000007FB0000-0x00000000080BA000-memory.dmp

    Filesize

    1.0MB

  • memory/4776-953-0x00000000080C0000-0x00000000080FC000-memory.dmp

    Filesize

    240KB

  • memory/4776-954-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-956-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-957-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-958-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/4776-959-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB