Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    226s
  • max time network
    253s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 18:42

General

  • Target

    d9dbb5f5765a806905d8b3549fa9cacf1e34df5405b0864fe40d08f437ebdbff.exe

  • Size

    642KB

  • MD5

    b46f41f327dbfd079ea39823239f30e9

  • SHA1

    dc99e4d11e00d65ee8adb9becae58865673344e0

  • SHA256

    d9dbb5f5765a806905d8b3549fa9cacf1e34df5405b0864fe40d08f437ebdbff

  • SHA512

    f22da5298b3de106a503f09d98d3532d425d4a5d7f50eed120a784af8084cbe519560bbcf1ccb44004c79a28836234807916b29aaef1cffc0cc1788ad1710282

  • SSDEEP

    12288:py908faSnidphYtt1b3vBP+WW61N1qbRKWA+B6Xp:pyVfaSiZM1DvxO61N1qbRZaXp

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9dbb5f5765a806905d8b3549fa9cacf1e34df5405b0864fe40d08f437ebdbff.exe
    "C:\Users\Admin\AppData\Local\Temp\d9dbb5f5765a806905d8b3549fa9cacf1e34df5405b0864fe40d08f437ebdbff.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st377174.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st377174.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\93151000.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\93151000.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1680
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp846203.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp846203.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1384

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st377174.exe

    Filesize

    488KB

    MD5

    a8cfca2e2945ebbf1bb88a2cc7a9a511

    SHA1

    88f8b8c324a6fc7e4f218f136526438f0cf58ac0

    SHA256

    cb739dcf65431ed5e3bce36927722f01c197a9407cd18fecfc957189d6f74cdf

    SHA512

    b10fb27ef043678700a60250484fc63699230718bad0874a02cdd3fa32804009d010adbc8cf5d2782acfc00a3b4aea8b6d120b6b1a5bff4961cf69cff52dd5f6

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st377174.exe

    Filesize

    488KB

    MD5

    a8cfca2e2945ebbf1bb88a2cc7a9a511

    SHA1

    88f8b8c324a6fc7e4f218f136526438f0cf58ac0

    SHA256

    cb739dcf65431ed5e3bce36927722f01c197a9407cd18fecfc957189d6f74cdf

    SHA512

    b10fb27ef043678700a60250484fc63699230718bad0874a02cdd3fa32804009d010adbc8cf5d2782acfc00a3b4aea8b6d120b6b1a5bff4961cf69cff52dd5f6

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\93151000.exe

    Filesize

    176KB

    MD5

    2b71f4b18ac8214a2bff547b6ce2f64f

    SHA1

    b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

    SHA256

    f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

    SHA512

    33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\93151000.exe

    Filesize

    176KB

    MD5

    2b71f4b18ac8214a2bff547b6ce2f64f

    SHA1

    b8f2f25139a7b2e8d5e8fbc024eb5cac518bc6a5

    SHA256

    f7eedf3aec775a62c265d1652686b30a8a45a953523e2fb3cfc1fac3c6a66fbc

    SHA512

    33518eff768610bf54f9888d9d0d746b0c3500dc5f2b8fd5f1641d5a264f657a8311b40364f70932512581183b244fec3feb535e21c13e0ec8adec9994175177

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp846203.exe

    Filesize

    340KB

    MD5

    6106457395f49a9dc652b2517cf7e7ba

    SHA1

    d0533ced6b98da466c7ed8fc9f9a9f5d0ced7f0e

    SHA256

    96638707890bedb3a5534ff8c37ff79118d193155e618bc2add87c5e4384e581

    SHA512

    6c81a594a5988f8ce30aa2e7008506850e4ba8a7b867df7b9c9401bd4a39e70f12de181549264cd607b9a5c2f201d1867ac2db3f7d6fd7c684c1a89ec3dc9af0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp846203.exe

    Filesize

    340KB

    MD5

    6106457395f49a9dc652b2517cf7e7ba

    SHA1

    d0533ced6b98da466c7ed8fc9f9a9f5d0ced7f0e

    SHA256

    96638707890bedb3a5534ff8c37ff79118d193155e618bc2add87c5e4384e581

    SHA512

    6c81a594a5988f8ce30aa2e7008506850e4ba8a7b867df7b9c9401bd4a39e70f12de181549264cd607b9a5c2f201d1867ac2db3f7d6fd7c684c1a89ec3dc9af0

  • memory/1384-213-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-225-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-993-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-991-0x000000000A440000-0x000000000A47C000-memory.dmp

    Filesize

    240KB

  • memory/1384-990-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-988-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-987-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-986-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-985-0x000000000A320000-0x000000000A42A000-memory.dmp

    Filesize

    1.0MB

  • memory/1384-984-0x000000000A300000-0x000000000A312000-memory.dmp

    Filesize

    72KB

  • memory/1384-194-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-221-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-196-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-192-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-223-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-207-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-219-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-217-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-215-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-211-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-209-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-187-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-188-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-190-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-206-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-983-0x0000000009CB0000-0x000000000A2C8000-memory.dmp

    Filesize

    6.1MB

  • memory/1384-205-0x0000000007370000-0x0000000007380000-memory.dmp

    Filesize

    64KB

  • memory/1384-198-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-200-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-202-0x0000000004D50000-0x0000000004D85000-memory.dmp

    Filesize

    212KB

  • memory/1384-203-0x0000000002BF0000-0x0000000002C36000-memory.dmp

    Filesize

    280KB

  • memory/1680-174-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-172-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-151-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-149-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1680-150-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1680-148-0x00000000049F0000-0x0000000004F94000-memory.dmp

    Filesize

    5.6MB

  • memory/1680-181-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1680-180-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1680-179-0x00000000049E0000-0x00000000049F0000-memory.dmp

    Filesize

    64KB

  • memory/1680-178-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-176-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-170-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-168-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-166-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-164-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-162-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-160-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-158-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-156-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-154-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB

  • memory/1680-152-0x0000000004950000-0x0000000004963000-memory.dmp

    Filesize

    76KB