Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/05/2023, 19:36

General

  • Target

    fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f.exe

  • Size

    696KB

  • MD5

    1feca7be483a7ede6047b2021bba9291

  • SHA1

    232052904b9db804906180ccf2ba113a90eb89e6

  • SHA256

    fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f

  • SHA512

    1a32cb9bde9022d2554b276eee3b05bc523d276f4dfd1a40df7b073f6adceb43418fada2ac18228acb13beaa336ce22a149da7f0edf850ab08b7de36133eb8d8

  • SSDEEP

    12288:zy90Tq4C00Xa9KJ2A/+tZ9CO3IhMY/NN4MWL6+718buKjA+KQujtlU:zyyqsfKoA/+tXCFneZ6+718bugIbjtlU

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f.exe
    "C:\Users\Admin\AppData\Local\Temp\fe6450a225302d7f9cab3ee73681548d9bf49e41bb42870ba21d374b04ef7e2f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3900
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 1080
          4⤵
          • Program crash
          PID:3500
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2936
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3900 -ip 3900
    1⤵
      PID:2660

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe

      Filesize

      541KB

      MD5

      b5ec3f70c6df9edfc2dace7f701f805d

      SHA1

      b3ed76d78cd26c6acd0e32c4b23f4c8bfa238bbc

      SHA256

      138fbb8de2e879362135632a6e5ef689388f0759e3854467a9817bcdb42bdf2c

      SHA512

      5edb7496511bb17330088a57f8a4900443ef7880e9c20ef40113019007b026341f383ab1923a8f409ba40832c45fb0302499309ecc819d20b6cbcb124fc1ee52

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un815342.exe

      Filesize

      541KB

      MD5

      b5ec3f70c6df9edfc2dace7f701f805d

      SHA1

      b3ed76d78cd26c6acd0e32c4b23f4c8bfa238bbc

      SHA256

      138fbb8de2e879362135632a6e5ef689388f0759e3854467a9817bcdb42bdf2c

      SHA512

      5edb7496511bb17330088a57f8a4900443ef7880e9c20ef40113019007b026341f383ab1923a8f409ba40832c45fb0302499309ecc819d20b6cbcb124fc1ee52

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

      Filesize

      258KB

      MD5

      88fc9da8525f441b05688e184a99a983

      SHA1

      16a4d0f6f1a16659897c092d00eb4f79e0f04b88

      SHA256

      23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

      SHA512

      31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\43383082.exe

      Filesize

      258KB

      MD5

      88fc9da8525f441b05688e184a99a983

      SHA1

      16a4d0f6f1a16659897c092d00eb4f79e0f04b88

      SHA256

      23533d104e8a7c6cf358a63f41dc01fbe03cfa6a6db87d898abd295de0f2ca9a

      SHA512

      31311ec3048fa731277370dee537351bd1cf4f07e975f586320d5ea64f70b477f0b32253001d6c2b363935aeafa96953a33343b3571fc989fdce7a67e5541ccb

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

      Filesize

      340KB

      MD5

      b16b06fb5c3aa4421d5ce16427673f03

      SHA1

      1411c24051963ac29d15f706d2c3140aad48bd06

      SHA256

      02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

      SHA512

      7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk342776.exe

      Filesize

      340KB

      MD5

      b16b06fb5c3aa4421d5ce16427673f03

      SHA1

      1411c24051963ac29d15f706d2c3140aad48bd06

      SHA256

      02b4a968e81c5cd1d05a161808e1d0ca93eff89dd6cef87d046a3ab18bcc9056

      SHA512

      7d4f4223b8956efec0473e0022fd79eda5d242be33f758e598c0f166bb5c438bead3665fa0dc4cc354a6090870345ad272b2dafbee2190d683e682a14042042f

    • memory/2936-210-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-218-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-993-0x00000000049E0000-0x00000000049F0000-memory.dmp

      Filesize

      64KB

    • memory/2936-992-0x00000000049E0000-0x00000000049F0000-memory.dmp

      Filesize

      64KB

    • memory/2936-991-0x00000000049E0000-0x00000000049F0000-memory.dmp

      Filesize

      64KB

    • memory/2936-989-0x000000000A480000-0x000000000A4BC000-memory.dmp

      Filesize

      240KB

    • memory/2936-988-0x00000000049E0000-0x00000000049F0000-memory.dmp

      Filesize

      64KB

    • memory/2936-199-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-986-0x000000000A300000-0x000000000A312000-memory.dmp

      Filesize

      72KB

    • memory/2936-985-0x0000000009C40000-0x000000000A258000-memory.dmp

      Filesize

      6.1MB

    • memory/2936-226-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-224-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-222-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-220-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-195-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-190-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-216-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-214-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-212-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-206-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-209-0x00000000049E0000-0x00000000049F0000-memory.dmp

      Filesize

      64KB

    • memory/2936-193-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-207-0x00000000049E0000-0x00000000049F0000-memory.dmp

      Filesize

      64KB

    • memory/2936-205-0x0000000002CC0000-0x0000000002D06000-memory.dmp

      Filesize

      280KB

    • memory/2936-191-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-197-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-203-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/2936-987-0x000000000A320000-0x000000000A42A000-memory.dmp

      Filesize

      1.0MB

    • memory/2936-201-0x0000000004B70000-0x0000000004BA5000-memory.dmp

      Filesize

      212KB

    • memory/3900-180-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-185-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/3900-152-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-150-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-149-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-184-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/3900-183-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/3900-148-0x0000000007280000-0x0000000007824000-memory.dmp

      Filesize

      5.6MB

    • memory/3900-181-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/3900-168-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-170-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-178-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/3900-172-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-176-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-177-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/3900-174-0x0000000007270000-0x0000000007280000-memory.dmp

      Filesize

      64KB

    • memory/3900-173-0x0000000002CB0000-0x0000000002CDD000-memory.dmp

      Filesize

      180KB

    • memory/3900-166-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-164-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-160-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-162-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-154-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-158-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB

    • memory/3900-156-0x0000000007110000-0x0000000007123000-memory.dmp

      Filesize

      76KB