Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    211s
  • max time network
    272s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 19:10

General

  • Target

    b71f27d0d52ebc4ab8a591ca482053d55b024c9bd04471c452cfa8aaf5e6914f.exe

  • Size

    480KB

  • MD5

    2ed22c263708e87ab098da0373af9419

  • SHA1

    73d5f2dac037fbf999eacda30f4420022f461185

  • SHA256

    b71f27d0d52ebc4ab8a591ca482053d55b024c9bd04471c452cfa8aaf5e6914f

  • SHA512

    d6ddb2d05adc4a65386e2cef1fc73926b04dca70810bd0bca11602ed64c688dd44fec161607f72d606114993adb95c63776540b8a61f1528d0bbc774fbcef12c

  • SSDEEP

    12288:NMrly90qs2yl2GFpORQiwAjuFDaFOYgc:0yRnyTFERQiLj+acNc

Malware Config

Signatures

  • Detects Redline Stealer samples 3 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b71f27d0d52ebc4ab8a591ca482053d55b024c9bd04471c452cfa8aaf5e6914f.exe
    "C:\Users\Admin\AppData\Local\Temp\b71f27d0d52ebc4ab8a591ca482053d55b024c9bd04471c452cfa8aaf5e6914f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1512
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7848907.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7848907.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4113310.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4113310.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3136
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0413473.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0413473.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7848907.exe

    Filesize

    308KB

    MD5

    044ba37dccb961700d3432dad2339dc1

    SHA1

    4a996a018e905c77e7259d91388e65724679ae1a

    SHA256

    aac8d020cee178815af487aaa84bab6859750fd780484b26c58ebe0e50db2fe6

    SHA512

    fb9308520c5c63ff8c55cc0daf814f40a1beb8cf7f256777224cfe513eaff7d014f33ffe0545d1c4b90bb745b3cabe30877b2804aa090b1ca6d398a69374e8e0

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v7848907.exe

    Filesize

    308KB

    MD5

    044ba37dccb961700d3432dad2339dc1

    SHA1

    4a996a018e905c77e7259d91388e65724679ae1a

    SHA256

    aac8d020cee178815af487aaa84bab6859750fd780484b26c58ebe0e50db2fe6

    SHA512

    fb9308520c5c63ff8c55cc0daf814f40a1beb8cf7f256777224cfe513eaff7d014f33ffe0545d1c4b90bb745b3cabe30877b2804aa090b1ca6d398a69374e8e0

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4113310.exe

    Filesize

    176KB

    MD5

    54d7144705c4cc7fc62aa7eff4658f07

    SHA1

    104029a24e480adf7cf3603137448a1893ae5bbf

    SHA256

    91b9701b0cfacb782dacd2ed87a91a230cf934c2d7e6af6fab728301e8d5a583

    SHA512

    1399468c8f54e57345cc83d7803ff2f5059051675fb25954ef12fa85dc7b633e71c8605e7653dc7bb09c260cee3c86c0ef2507264706ef79547a25e64938f95a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\a4113310.exe

    Filesize

    176KB

    MD5

    54d7144705c4cc7fc62aa7eff4658f07

    SHA1

    104029a24e480adf7cf3603137448a1893ae5bbf

    SHA256

    91b9701b0cfacb782dacd2ed87a91a230cf934c2d7e6af6fab728301e8d5a583

    SHA512

    1399468c8f54e57345cc83d7803ff2f5059051675fb25954ef12fa85dc7b633e71c8605e7653dc7bb09c260cee3c86c0ef2507264706ef79547a25e64938f95a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0413473.exe

    Filesize

    136KB

    MD5

    846aec6f1281bfdaaa504fa81f93aac8

    SHA1

    11ace8cd08e165c4c76d92f7c46d13f8363164b0

    SHA256

    84e84d7bb12c81aab3090430280e01f0ad105d751fced11c41be4d590c21df27

    SHA512

    54feddee3661aa0458257c20f5b425c907c4e980bf082788863d67c4ad1fffd777e6f45588546d09e82cfea029fbe0cfe50b5c4a68af79b93ceff13569a6177f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\b0413473.exe

    Filesize

    136KB

    MD5

    846aec6f1281bfdaaa504fa81f93aac8

    SHA1

    11ace8cd08e165c4c76d92f7c46d13f8363164b0

    SHA256

    84e84d7bb12c81aab3090430280e01f0ad105d751fced11c41be4d590c21df27

    SHA512

    54feddee3661aa0458257c20f5b425c907c4e980bf082788863d67c4ad1fffd777e6f45588546d09e82cfea029fbe0cfe50b5c4a68af79b93ceff13569a6177f

  • memory/3136-171-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-177-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-151-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/3136-152-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/3136-153-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/3136-154-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-155-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-157-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-161-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-159-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-163-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-165-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-167-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-169-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-149-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/3136-173-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-175-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-150-0x0000000004A70000-0x0000000005014000-memory.dmp

    Filesize

    5.6MB

  • memory/3136-179-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-181-0x0000000004960000-0x0000000004972000-memory.dmp

    Filesize

    72KB

  • memory/3136-148-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/3136-147-0x0000000004A60000-0x0000000004A70000-memory.dmp

    Filesize

    64KB

  • memory/3884-192-0x0000000007490000-0x00000000074A0000-memory.dmp

    Filesize

    64KB

  • memory/3884-198-0x0000000008BF0000-0x0000000008DB2000-memory.dmp

    Filesize

    1.8MB

  • memory/3884-188-0x0000000007080000-0x0000000007092000-memory.dmp

    Filesize

    72KB

  • memory/3884-189-0x00000000071E0000-0x00000000072EA000-memory.dmp

    Filesize

    1.0MB

  • memory/3884-190-0x0000000007490000-0x00000000074A0000-memory.dmp

    Filesize

    64KB

  • memory/3884-191-0x00000000074A0000-0x00000000074DC000-memory.dmp

    Filesize

    240KB

  • memory/3884-194-0x0000000007FF0000-0x0000000008082000-memory.dmp

    Filesize

    584KB

  • memory/3884-186-0x0000000000370000-0x0000000000398000-memory.dmp

    Filesize

    160KB

  • memory/3884-187-0x0000000007610000-0x0000000007C28000-memory.dmp

    Filesize

    6.1MB

  • memory/3884-195-0x0000000008110000-0x0000000008186000-memory.dmp

    Filesize

    472KB

  • memory/3884-196-0x0000000008090000-0x00000000080AE000-memory.dmp

    Filesize

    120KB

  • memory/3884-197-0x0000000008220000-0x0000000008270000-memory.dmp

    Filesize

    320KB

  • memory/3884-193-0x0000000007CE0000-0x0000000007D46000-memory.dmp

    Filesize

    408KB

  • memory/3884-199-0x00000000092F0000-0x000000000981C000-memory.dmp

    Filesize

    5.2MB