Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 19:04

General

  • Target

    b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe

  • Size

    612KB

  • MD5

    612f4040afe23ac58d15457210cdb6a2

  • SHA1

    729167244b6b37c216691587d28c56c74e3bb0bc

  • SHA256

    b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257

  • SHA512

    727917efb2d827b9bcdde2136da6735b41762699c2b4a033d53700cdd5a3ef0bd29e051fa2250117af064e32ee405b6481b8437362a27cdc931ce0724481dc46

  • SSDEEP

    12288:Cy90jRTJOX3Umld8k3yjlmbMdelZIqNPORukFYS15qUHh:Cy4RTJOnH3KgbMyfNPoukF7Hh

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe
    "C:\Users\Admin\AppData\Local\Temp\b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st627254.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st627254.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2352
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\06714153.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\06714153.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4432
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp295110.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp295110.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4492

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st627254.exe

    Filesize

    457KB

    MD5

    6b1ffd0137a50e56a8beb3dabcab9311

    SHA1

    ee341e44443e7166965de0661cdcbaa6547c3c62

    SHA256

    d4478653bc580c42e97663a822e36c98c6b8d838b234a2c2f8a06245da4561dc

    SHA512

    6b67c3a3de584a537d3bea654a4ff3a9526bb4275c9836924995eabb697a6133d9c9f3b7bf098f52efed3dc9c6bcc20ba1b00118b09caed6118a88e3a5b26f79

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st627254.exe

    Filesize

    457KB

    MD5

    6b1ffd0137a50e56a8beb3dabcab9311

    SHA1

    ee341e44443e7166965de0661cdcbaa6547c3c62

    SHA256

    d4478653bc580c42e97663a822e36c98c6b8d838b234a2c2f8a06245da4561dc

    SHA512

    6b67c3a3de584a537d3bea654a4ff3a9526bb4275c9836924995eabb697a6133d9c9f3b7bf098f52efed3dc9c6bcc20ba1b00118b09caed6118a88e3a5b26f79

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\06714153.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\06714153.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp295110.exe

    Filesize

    459KB

    MD5

    ec00f1d7f36385ffcc29efcd6e453122

    SHA1

    130eb75ae10c083d21f61df84747153d2bef1e84

    SHA256

    3bd9d67e5626b5fa454134c878d9d5aab3d34be4f9da410ef761c5085d76adaf

    SHA512

    75f9e8c9b3d39996bc2accaea8a7c04ff653be41b289e9e91718022e97cfa1607a5dbb992ca622e8963382c72d1c5e5b1ec6ebec80629d9a7c59b433c43ef547

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp295110.exe

    Filesize

    459KB

    MD5

    ec00f1d7f36385ffcc29efcd6e453122

    SHA1

    130eb75ae10c083d21f61df84747153d2bef1e84

    SHA256

    3bd9d67e5626b5fa454134c878d9d5aab3d34be4f9da410ef761c5085d76adaf

    SHA512

    75f9e8c9b3d39996bc2accaea8a7c04ff653be41b289e9e91718022e97cfa1607a5dbb992ca622e8963382c72d1c5e5b1ec6ebec80629d9a7c59b433c43ef547

  • memory/4432-147-0x0000000000920000-0x000000000092A000-memory.dmp

    Filesize

    40KB

  • memory/4492-153-0x0000000000960000-0x00000000009A6000-memory.dmp

    Filesize

    280KB

  • memory/4492-154-0x0000000004F70000-0x0000000005514000-memory.dmp

    Filesize

    5.6MB

  • memory/4492-155-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-156-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-157-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-158-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-159-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-161-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-163-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-165-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-167-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-169-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-171-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-173-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-175-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-177-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-179-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-181-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-183-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-185-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-187-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-189-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-191-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-193-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-195-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-197-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-199-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-201-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-203-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-205-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-207-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-209-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-211-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-213-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-215-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-217-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-219-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-221-0x0000000002AE0000-0x0000000002B15000-memory.dmp

    Filesize

    212KB

  • memory/4492-950-0x00000000079F0000-0x0000000008008000-memory.dmp

    Filesize

    6.1MB

  • memory/4492-951-0x00000000080B0000-0x00000000080C2000-memory.dmp

    Filesize

    72KB

  • memory/4492-952-0x00000000080D0000-0x00000000081DA000-memory.dmp

    Filesize

    1.0MB

  • memory/4492-953-0x00000000081F0000-0x000000000822C000-memory.dmp

    Filesize

    240KB

  • memory/4492-954-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-956-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-957-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-958-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB

  • memory/4492-959-0x0000000002730000-0x0000000002740000-memory.dmp

    Filesize

    64KB