Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe
Resource
win10v2004-20230220-en
General
-
Target
b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe
-
Size
612KB
-
MD5
612f4040afe23ac58d15457210cdb6a2
-
SHA1
729167244b6b37c216691587d28c56c74e3bb0bc
-
SHA256
b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257
-
SHA512
727917efb2d827b9bcdde2136da6735b41762699c2b4a033d53700cdd5a3ef0bd29e051fa2250117af064e32ee405b6481b8437362a27cdc931ce0724481dc46
-
SSDEEP
12288:Cy90jRTJOX3Umld8k3yjlmbMdelZIqNPORukFYS15qUHh:Cy4RTJOnH3KgbMyfNPoukF7Hh
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/4492-950-0x00000000079F0000-0x0000000008008000-memory.dmp redline_stealer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 06714153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 06714153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 06714153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 06714153.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 06714153.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 06714153.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 2352 st627254.exe 4432 06714153.exe 4492 kp295110.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 06714153.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce st627254.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" st627254.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4432 06714153.exe 4432 06714153.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4432 06714153.exe Token: SeDebugPrivilege 4492 kp295110.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 864 wrote to memory of 2352 864 b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe 83 PID 864 wrote to memory of 2352 864 b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe 83 PID 864 wrote to memory of 2352 864 b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe 83 PID 2352 wrote to memory of 4432 2352 st627254.exe 84 PID 2352 wrote to memory of 4432 2352 st627254.exe 84 PID 2352 wrote to memory of 4492 2352 st627254.exe 87 PID 2352 wrote to memory of 4492 2352 st627254.exe 87 PID 2352 wrote to memory of 4492 2352 st627254.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe"C:\Users\Admin\AppData\Local\Temp\b1d4d450fcaf454b68f0774bc97a6d03efb606d8df4e8ae5a4d8a97a0de21257.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st627254.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st627254.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\06714153.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\06714153.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp295110.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp295110.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
457KB
MD56b1ffd0137a50e56a8beb3dabcab9311
SHA1ee341e44443e7166965de0661cdcbaa6547c3c62
SHA256d4478653bc580c42e97663a822e36c98c6b8d838b234a2c2f8a06245da4561dc
SHA5126b67c3a3de584a537d3bea654a4ff3a9526bb4275c9836924995eabb697a6133d9c9f3b7bf098f52efed3dc9c6bcc20ba1b00118b09caed6118a88e3a5b26f79
-
Filesize
457KB
MD56b1ffd0137a50e56a8beb3dabcab9311
SHA1ee341e44443e7166965de0661cdcbaa6547c3c62
SHA256d4478653bc580c42e97663a822e36c98c6b8d838b234a2c2f8a06245da4561dc
SHA5126b67c3a3de584a537d3bea654a4ff3a9526bb4275c9836924995eabb697a6133d9c9f3b7bf098f52efed3dc9c6bcc20ba1b00118b09caed6118a88e3a5b26f79
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
459KB
MD5ec00f1d7f36385ffcc29efcd6e453122
SHA1130eb75ae10c083d21f61df84747153d2bef1e84
SHA2563bd9d67e5626b5fa454134c878d9d5aab3d34be4f9da410ef761c5085d76adaf
SHA51275f9e8c9b3d39996bc2accaea8a7c04ff653be41b289e9e91718022e97cfa1607a5dbb992ca622e8963382c72d1c5e5b1ec6ebec80629d9a7c59b433c43ef547
-
Filesize
459KB
MD5ec00f1d7f36385ffcc29efcd6e453122
SHA1130eb75ae10c083d21f61df84747153d2bef1e84
SHA2563bd9d67e5626b5fa454134c878d9d5aab3d34be4f9da410ef761c5085d76adaf
SHA51275f9e8c9b3d39996bc2accaea8a7c04ff653be41b289e9e91718022e97cfa1607a5dbb992ca622e8963382c72d1c5e5b1ec6ebec80629d9a7c59b433c43ef547