Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 19:03

General

  • Target

    b0ef5bafdc181862d4819522ee512b7d5ece0a224be6653cc07301ebd2d3c8f5.exe

  • Size

    690KB

  • MD5

    e9cecfead46812d6bb2ece041f1b5f5c

  • SHA1

    603423ddeb419635af05b0424c50acc60e2872b6

  • SHA256

    b0ef5bafdc181862d4819522ee512b7d5ece0a224be6653cc07301ebd2d3c8f5

  • SHA512

    97a2675335f13614a213c7578cc89b6227354bbaf17bf766cd5cf9a393cbc31307564176cb20b7b2de23bef5fc722d993669530291d0facbb34b5f9784f26fca

  • SSDEEP

    12288:ey90lGXw96zRbbWKz5bo79ZDgUuPd/e5SSNIc/JxDkkdWqpBTcEb+s:eyWGXTRt0Xsmf7xDkkcqp+bs

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b0ef5bafdc181862d4819522ee512b7d5ece0a224be6653cc07301ebd2d3c8f5.exe
    "C:\Users\Admin\AppData\Local\Temp\b0ef5bafdc181862d4819522ee512b7d5ece0a224be6653cc07301ebd2d3c8f5.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un168236.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un168236.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25394030.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25394030.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2932
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2932 -s 1080
          4⤵
          • Program crash
          PID:4116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812873.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812873.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4976
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2932 -ip 2932
    1⤵
      PID:4908

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un168236.exe

      Filesize

      536KB

      MD5

      d952305ede611c7b7522b370bbf62385

      SHA1

      0b6d86e44ebe82da2940ca080b4c9fac7ce46dc4

      SHA256

      351a08b220f5fb3a4e74d6fe8a5d21910f5d7a339723d92fe0e258c3ea1c09f6

      SHA512

      0e2bcb17cef7fa7009bc95d6b56581eaafe45c74b5ace930a2ad298f3a863ef6f0dcc03402eb975e02daf82f874b10ae0d0e0a48f6255d69d18046102d620568

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un168236.exe

      Filesize

      536KB

      MD5

      d952305ede611c7b7522b370bbf62385

      SHA1

      0b6d86e44ebe82da2940ca080b4c9fac7ce46dc4

      SHA256

      351a08b220f5fb3a4e74d6fe8a5d21910f5d7a339723d92fe0e258c3ea1c09f6

      SHA512

      0e2bcb17cef7fa7009bc95d6b56581eaafe45c74b5ace930a2ad298f3a863ef6f0dcc03402eb975e02daf82f874b10ae0d0e0a48f6255d69d18046102d620568

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25394030.exe

      Filesize

      259KB

      MD5

      717503a4a1a8cff617480edc2584b656

      SHA1

      1f06f3c2220a06da4adcf3b803235eb6402f00c6

      SHA256

      f7ac453ed8863bd0c1ccbd3211178bedf2d96f6684eb0e7944b33e812b35a9c6

      SHA512

      4647e7740a181a282256b8d4cd6eca28ee3494738adbabf3bad514759f1d48c89b362b93f16b1115c0dd57fa09f141c01eec58aa84c809e7256a37f2466931ed

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\25394030.exe

      Filesize

      259KB

      MD5

      717503a4a1a8cff617480edc2584b656

      SHA1

      1f06f3c2220a06da4adcf3b803235eb6402f00c6

      SHA256

      f7ac453ed8863bd0c1ccbd3211178bedf2d96f6684eb0e7944b33e812b35a9c6

      SHA512

      4647e7740a181a282256b8d4cd6eca28ee3494738adbabf3bad514759f1d48c89b362b93f16b1115c0dd57fa09f141c01eec58aa84c809e7256a37f2466931ed

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812873.exe

      Filesize

      342KB

      MD5

      07592f4f06ec5251932914963ddb9c5b

      SHA1

      bb87c618ef9495a1c8ea60a7cfeee1af79b907ef

      SHA256

      e98bb68f40f15f2f122c305ea419fd9a1d87e952826af6f28dec013d467ab2bf

      SHA512

      2225ddb51380fe3c9b0649d8c17d25742d4f799be623782590ab5452e48560d1933f0576feec9f7aba60c3da3ac38483ee1b7422e2b1f434f6753448c9b4b4c2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812873.exe

      Filesize

      342KB

      MD5

      07592f4f06ec5251932914963ddb9c5b

      SHA1

      bb87c618ef9495a1c8ea60a7cfeee1af79b907ef

      SHA256

      e98bb68f40f15f2f122c305ea419fd9a1d87e952826af6f28dec013d467ab2bf

      SHA512

      2225ddb51380fe3c9b0649d8c17d25742d4f799be623782590ab5452e48560d1933f0576feec9f7aba60c3da3ac38483ee1b7422e2b1f434f6753448c9b4b4c2

    • memory/2932-166-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-151-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/2932-152-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/2932-153-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-154-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-156-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-158-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-160-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-162-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-150-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/2932-170-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-168-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-164-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-172-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-174-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-176-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-178-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-180-0x0000000002460000-0x0000000002473000-memory.dmp

      Filesize

      76KB

    • memory/2932-181-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2932-182-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/2932-183-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/2932-184-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/2932-186-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/2932-149-0x00000000005C0000-0x00000000005ED000-memory.dmp

      Filesize

      180KB

    • memory/2932-148-0x0000000004BB0000-0x0000000005154000-memory.dmp

      Filesize

      5.6MB

    • memory/4976-409-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-204-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-194-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-988-0x0000000007BC0000-0x0000000007BD2000-memory.dmp

      Filesize

      72KB

    • memory/4976-200-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-210-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-212-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-218-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-224-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-222-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-220-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-216-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-214-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-208-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-206-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-191-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-198-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-196-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-405-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-403-0x0000000002120000-0x0000000002166000-memory.dmp

      Filesize

      280KB

    • memory/4976-192-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-406-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-987-0x0000000007590000-0x0000000007BA8000-memory.dmp

      Filesize

      6.1MB

    • memory/4976-202-0x0000000004A10000-0x0000000004A45000-memory.dmp

      Filesize

      212KB

    • memory/4976-989-0x0000000007BE0000-0x0000000007CEA000-memory.dmp

      Filesize

      1.0MB

    • memory/4976-990-0x0000000007D40000-0x0000000007D7C000-memory.dmp

      Filesize

      240KB

    • memory/4976-991-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-993-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-994-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-995-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB

    • memory/4976-996-0x0000000004B50000-0x0000000004B60000-memory.dmp

      Filesize

      64KB