Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 18:33

General

  • Target

    d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7.exe

  • Size

    611KB

  • MD5

    8014ae9b23a0e6d6f5bb01b2495f9c54

  • SHA1

    7d2fbcf2c6ae97abde9ed3dc8c90f5d2b8edf920

  • SHA256

    d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7

  • SHA512

    89bce67d148cca59467b46af1aa58842c8ecc6b0e674513ab175d63ddde257971edf4475b306c93d8f31218d0992f1602c13d5aeb4d104e1549b0fa4914537f9

  • SSDEEP

    12288:Ky901ewSvw3XmTAk3qbdLKZnfrXfS0NhdYX91le7X1:Kywe1i2TAk6xLorXfa96L1

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7.exe
    "C:\Users\Admin\AppData\Local\Temp\d03cbd58c678636f83ffbd13e07784124672ba8908c0e95c6293106ec72885d7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2188
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5056
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2604
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2236

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe

    Filesize

    457KB

    MD5

    06d3b78530286575b32cd19381f27b4e

    SHA1

    d9a65642e96df110d4151944e803ca0dcf63d706

    SHA256

    df91a2ce0c716220ca457ce88ea568bedfa69309b4dc504cb2c03396fef08005

    SHA512

    50fd4f6d8d87c7cb8fdbecd67dfae97749c4562e548c5d9198ffe1bcb60cdc2730233378d9a3dc339dfcd92b02f184f54b1b9eb40748b6a6bf7d2f69b71530c1

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st531230.exe

    Filesize

    457KB

    MD5

    06d3b78530286575b32cd19381f27b4e

    SHA1

    d9a65642e96df110d4151944e803ca0dcf63d706

    SHA256

    df91a2ce0c716220ca457ce88ea568bedfa69309b4dc504cb2c03396fef08005

    SHA512

    50fd4f6d8d87c7cb8fdbecd67dfae97749c4562e548c5d9198ffe1bcb60cdc2730233378d9a3dc339dfcd92b02f184f54b1b9eb40748b6a6bf7d2f69b71530c1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\22517135.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp349817.exe

    Filesize

    459KB

    MD5

    1d016cdd1baeddc8f113d58cd7565cb3

    SHA1

    63b5cae741e33cca04258688f138b3a8c12d0b57

    SHA256

    e203a12d8551312e0d7e33edcebda5f4fe019886e1b65cf4a5ee0aa89b8a10e1

    SHA512

    61398c26da5f7f7eb7e236536fcc924f63f835050191e6b8f6e33e24968cbca45152f80e9616f741d287ca2f91b6587e60a4cf17680b6cfaf007abc94c694a6e

  • memory/2236-153-0x0000000000820000-0x0000000000866000-memory.dmp

    Filesize

    280KB

  • memory/2236-154-0x0000000000400000-0x0000000000817000-memory.dmp

    Filesize

    4.1MB

  • memory/2236-156-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-157-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-158-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-159-0x0000000004DB0000-0x0000000005354000-memory.dmp

    Filesize

    5.6MB

  • memory/2236-161-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-162-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-163-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-165-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-167-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-173-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-177-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-175-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-181-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-179-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-171-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-185-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-183-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-169-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-191-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-193-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-201-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-203-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-205-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-209-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-207-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-219-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-221-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-217-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-215-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-213-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-211-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-199-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-197-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-195-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-189-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-187-0x00000000053A0000-0x00000000053D5000-memory.dmp

    Filesize

    212KB

  • memory/2236-668-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-955-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-956-0x00000000078B0000-0x0000000007EC8000-memory.dmp

    Filesize

    6.1MB

  • memory/2236-957-0x0000000007F70000-0x0000000007F82000-memory.dmp

    Filesize

    72KB

  • memory/2236-958-0x0000000007F90000-0x000000000809A000-memory.dmp

    Filesize

    1.0MB

  • memory/2236-960-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2236-961-0x0000000008330000-0x000000000836C000-memory.dmp

    Filesize

    240KB

  • memory/2236-963-0x0000000002920000-0x0000000002930000-memory.dmp

    Filesize

    64KB

  • memory/2604-147-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

    Filesize

    40KB