Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 19:25

General

  • Target

    c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09.exe

  • Size

    695KB

  • MD5

    2b33a0ff9afe21bba8070386738dd9a1

  • SHA1

    36853c50dc3d9498f2c989f12d11688555e72b29

  • SHA256

    c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09

  • SHA512

    f3bd20a5bef7984eb95475ceab8c74b4e721026e22cdb5dc93db62c102c4edccafa61bb9fdf22ed97f6d8cc8d24c50bfe8e3f9ac82ff0a70fb191a0be34a1056

  • SSDEEP

    12288:ey90tiWyrr2PoTl/Y7TfZdkpD1K4M0QNi8/4PTZdoXfwQ1yiZUDZf7Wg:eyYyPRyfZ2w0Q9QPTzovwQOgg

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09.exe
    "C:\Users\Admin\AppData\Local\Temp\c1632a93dc892ed28ae8861398f25db3b117c843864581eeba25ef29267cee09.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1820
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 1016
          4⤵
          • Program crash
          PID:1560
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1084
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1820 -ip 1820
    1⤵
      PID:1816

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe

      Filesize

      541KB

      MD5

      e8bebe50132975fa77d11fabcc4f4526

      SHA1

      45f227db2669134d18368a39ad6e0892c17a90f7

      SHA256

      6672ae09ef0ab01d41161d9d792caab248271f5d29c917eb6b28ae31f6c75bbc

      SHA512

      051279fc1b54bf7c92c00b6b9fea259ea16fbf0711b2c37ae13044cbca2dfa0c35a997b0ef344060ef4d6918855f2e663eba43f2d44930351b2a7a02f1c640c7

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un299961.exe

      Filesize

      541KB

      MD5

      e8bebe50132975fa77d11fabcc4f4526

      SHA1

      45f227db2669134d18368a39ad6e0892c17a90f7

      SHA256

      6672ae09ef0ab01d41161d9d792caab248271f5d29c917eb6b28ae31f6c75bbc

      SHA512

      051279fc1b54bf7c92c00b6b9fea259ea16fbf0711b2c37ae13044cbca2dfa0c35a997b0ef344060ef4d6918855f2e663eba43f2d44930351b2a7a02f1c640c7

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

      Filesize

      258KB

      MD5

      0456d29cd856a216de10ea210144af2d

      SHA1

      a6f4933df5d1845ff198ea1e031960d8f37baf22

      SHA256

      78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

      SHA512

      af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\19985000.exe

      Filesize

      258KB

      MD5

      0456d29cd856a216de10ea210144af2d

      SHA1

      a6f4933df5d1845ff198ea1e031960d8f37baf22

      SHA256

      78cb54a66a0ad873b22677c5ccfeee4a503da0a8a0fc516d96104ac1de3e027d

      SHA512

      af526de445cc261c74146839212010cb4ffa0eb5a6dac2d6f0b1c633b217304a557c2c1aac3cf1948e00c9e5345b08051c0f65eb57cd7bea471e6d2a31fb4677

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

      Filesize

      340KB

      MD5

      798cf522a76e389588fa71cb8d5e0c46

      SHA1

      e221cf88d35b49f6c57a359a239857114289e0f7

      SHA256

      f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

      SHA512

      ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk880250.exe

      Filesize

      340KB

      MD5

      798cf522a76e389588fa71cb8d5e0c46

      SHA1

      e221cf88d35b49f6c57a359a239857114289e0f7

      SHA256

      f7e30143393a333d44f09efe1d6c0d224ff8f4b5efedbec30e435901ad39cb9b

      SHA512

      ae000d0bd6b55ad8a1d4e2807c98b9ecfa9da85e6152ef9f57fdce6f77fe1bb525d2a8a1865ab8ee0b76f1f229896d2d00f04ec07ba52d0b90c43374284b4606

    • memory/1084-214-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-193-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-997-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-996-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-995-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-993-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-992-0x000000000A440000-0x000000000A47C000-memory.dmp

      Filesize

      240KB

    • memory/1084-991-0x000000000A320000-0x000000000A42A000-memory.dmp

      Filesize

      1.0MB

    • memory/1084-990-0x000000000A300000-0x000000000A312000-memory.dmp

      Filesize

      72KB

    • memory/1084-989-0x0000000009CE0000-0x000000000A2F8000-memory.dmp

      Filesize

      6.1MB

    • memory/1084-194-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-444-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-196-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-200-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-440-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-439-0x0000000002BF0000-0x0000000002C36000-memory.dmp

      Filesize

      280KB

    • memory/1084-222-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-220-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-218-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-216-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-212-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-210-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-208-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-206-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-204-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-443-0x00000000073A0000-0x00000000073B0000-memory.dmp

      Filesize

      64KB

    • memory/1084-202-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1084-198-0x0000000004D70000-0x0000000004DA5000-memory.dmp

      Filesize

      212KB

    • memory/1820-171-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-179-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-153-0x00000000073C0000-0x00000000073D0000-memory.dmp

      Filesize

      64KB

    • memory/1820-149-0x0000000002C70000-0x0000000002C9D000-memory.dmp

      Filesize

      180KB

    • memory/1820-152-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-185-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/1820-184-0x00000000073C0000-0x00000000073D0000-memory.dmp

      Filesize

      64KB

    • memory/1820-183-0x00000000073C0000-0x00000000073D0000-memory.dmp

      Filesize

      64KB

    • memory/1820-148-0x00000000073D0000-0x0000000007974000-memory.dmp

      Filesize

      5.6MB

    • memory/1820-182-0x00000000073C0000-0x00000000073D0000-memory.dmp

      Filesize

      64KB

    • memory/1820-180-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/1820-165-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-167-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-169-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-173-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-177-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-175-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-163-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-161-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-159-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-157-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-155-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-150-0x0000000004A90000-0x0000000004AA3000-memory.dmp

      Filesize

      76KB

    • memory/1820-151-0x00000000073C0000-0x00000000073D0000-memory.dmp

      Filesize

      64KB