Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe
Resource
win10v2004-20230220-en
General
-
Target
0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe
-
Size
566KB
-
MD5
b0010a1a466b6912599e9dbfb9b0f2b1
-
SHA1
992a31e660ca6c51290a20924328f650d1633011
-
SHA256
0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8
-
SHA512
14d7c4f48ef015eaa5e99c8581d99e1c5773781a92289c2ce43a305ce538b58933de8da9cca01255b3a74427fbb91776a721ceb90552f6b8843203d7d999c1b2
-
SSDEEP
12288:jy90BhqdRBkZ71iu7CVoJkL07+QsKS+yw/lBJasjt6YNN:jyMhERBkZ71bO2JU4+tKS+ywXJaU7j
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/1900-950-0x0000000009CB0000-0x000000000A2C8000-memory.dmp redline_stealer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it938342.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it938342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it938342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it938342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it938342.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it938342.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 3740 zizB6138.exe 3080 it938342.exe 1900 kp117300.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it938342.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zizB6138.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zizB6138.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3080 it938342.exe 3080 it938342.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3080 it938342.exe Token: SeDebugPrivilege 1900 kp117300.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1176 wrote to memory of 3740 1176 0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe 86 PID 1176 wrote to memory of 3740 1176 0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe 86 PID 1176 wrote to memory of 3740 1176 0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe 86 PID 3740 wrote to memory of 3080 3740 zizB6138.exe 87 PID 3740 wrote to memory of 3080 3740 zizB6138.exe 87 PID 3740 wrote to memory of 1900 3740 zizB6138.exe 88 PID 3740 wrote to memory of 1900 3740 zizB6138.exe 88 PID 3740 wrote to memory of 1900 3740 zizB6138.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe"C:\Users\Admin\AppData\Local\Temp\0d7f1e7de2ae297dbd26cecd040402904baa81c1ea04695ee79c3b10a75e66b8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizB6138.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zizB6138.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it938342.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\it938342.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp117300.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp117300.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
412KB
MD5604268bb5844d0f0b285a29274685b5e
SHA16375d94bce9eb8fcaa8fd9fbfd8ba59d76c59897
SHA25641178b161c637a27b85959879f6cd9775cb1b91c3d96ba5144a6fabe7483e4f0
SHA512b35c079ffe3e5660bcbf070eab16aced9b94bd26ee3a2bfd7c311215ba49f1f1152e3ae42f7e02240fa41046873af14fcbf81e698b525115418ad847d08a81e4
-
Filesize
412KB
MD5604268bb5844d0f0b285a29274685b5e
SHA16375d94bce9eb8fcaa8fd9fbfd8ba59d76c59897
SHA25641178b161c637a27b85959879f6cd9775cb1b91c3d96ba5144a6fabe7483e4f0
SHA512b35c079ffe3e5660bcbf070eab16aced9b94bd26ee3a2bfd7c311215ba49f1f1152e3ae42f7e02240fa41046873af14fcbf81e698b525115418ad847d08a81e4
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
368KB
MD58cf19a8aafab304c716a0e914ba740c2
SHA1f409e0eef01ff8b484f66528d9b3a778571c5554
SHA25650999f92e76816aa5632fb5f42ba2a388c74ba0a15a6de3a5e63f344da91416d
SHA5129d168d0e7790981fa9d0b90d6bef94a06c135d801b2f700b88d69a5a284f8dd42a065b2c18166e624b8c086a49902a6f0d04d6a048938f8e4e52a8ac99355482
-
Filesize
368KB
MD58cf19a8aafab304c716a0e914ba740c2
SHA1f409e0eef01ff8b484f66528d9b3a778571c5554
SHA25650999f92e76816aa5632fb5f42ba2a388c74ba0a15a6de3a5e63f344da91416d
SHA5129d168d0e7790981fa9d0b90d6bef94a06c135d801b2f700b88d69a5a284f8dd42a065b2c18166e624b8c086a49902a6f0d04d6a048938f8e4e52a8ac99355482