Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 19:14

General

  • Target

    bad970a5bf84591bff5372c741cb5feefe0da9d6f593963ac87e6ca062cd42e3.exe

  • Size

    694KB

  • MD5

    82d4e596aeb90063fe45024690da3016

  • SHA1

    06001ca0047925ff3936b0156c0ffe9555ce17f1

  • SHA256

    bad970a5bf84591bff5372c741cb5feefe0da9d6f593963ac87e6ca062cd42e3

  • SHA512

    78a512b43ab4e47778023767eb4bc098283b83b3e1d542d2a758064b1055925ba1c9ed4381c68617f6e12247e2a25496fcb942320f34ccde6f27b98261223fde

  • SSDEEP

    12288:ey90Yhw6TP/IZ33DlblZV/VOIAwpFT6ETU4U/uvxWb6Fn18b2KQA+LNDLBCE:eyVCo4ZnDtVdOIAoF7TJu6Fn18b2LvcE

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bad970a5bf84591bff5372c741cb5feefe0da9d6f593963ac87e6ca062cd42e3.exe
    "C:\Users\Admin\AppData\Local\Temp\bad970a5bf84591bff5372c741cb5feefe0da9d6f593963ac87e6ca062cd42e3.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un958203.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un958203.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01297549.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01297549.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1080
          4⤵
          • Program crash
          PID:4420
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk696020.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk696020.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1448
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4116 -ip 4116
    1⤵
      PID:4916

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un958203.exe

      Filesize

      540KB

      MD5

      11fdda31ff49e411ea64be8553fcd892

      SHA1

      f4c5dec4fd247eda13725410efd43a1df0d5237b

      SHA256

      08af21716858e92c3775bfc368569bde3f996cb6fb5544314e68f1a947063f75

      SHA512

      0a97aa3ccd1b31964ad95267a9128f3c949d30e5a7d4690bc88c5a46ec66fb41dbdb367927d7050565428abe15c6eb36962fcabb4a0dde84c96c05a2c702183a

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un958203.exe

      Filesize

      540KB

      MD5

      11fdda31ff49e411ea64be8553fcd892

      SHA1

      f4c5dec4fd247eda13725410efd43a1df0d5237b

      SHA256

      08af21716858e92c3775bfc368569bde3f996cb6fb5544314e68f1a947063f75

      SHA512

      0a97aa3ccd1b31964ad95267a9128f3c949d30e5a7d4690bc88c5a46ec66fb41dbdb367927d7050565428abe15c6eb36962fcabb4a0dde84c96c05a2c702183a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01297549.exe

      Filesize

      258KB

      MD5

      7c18c5ea3d01ba3f69f25cb118a93d46

      SHA1

      d15321882c82bea966e6ba370d611f81c9f4fcea

      SHA256

      5b311eefd8120f48210231bd346197109dd80cf17210bbb083ba0087a9203da0

      SHA512

      7719bfc858c4cacd6e442d983a28bf5477cd1bbbbac22b9dbbb6de7d16fce98a47dc3afdeac456311af4af780ddc17e10dc6c1cd9128a6ac80a628190ce2d4d0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\01297549.exe

      Filesize

      258KB

      MD5

      7c18c5ea3d01ba3f69f25cb118a93d46

      SHA1

      d15321882c82bea966e6ba370d611f81c9f4fcea

      SHA256

      5b311eefd8120f48210231bd346197109dd80cf17210bbb083ba0087a9203da0

      SHA512

      7719bfc858c4cacd6e442d983a28bf5477cd1bbbbac22b9dbbb6de7d16fce98a47dc3afdeac456311af4af780ddc17e10dc6c1cd9128a6ac80a628190ce2d4d0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk696020.exe

      Filesize

      340KB

      MD5

      cf4fbbd5a2c9d18eb213c9235fca5488

      SHA1

      3b6c02caf775dcedf1b9cdf2586d5bf6871b5f6b

      SHA256

      1d15597e7aa6e4e46abc33b2f9e689b8a812d0365e28faaa653c2fbb84c2d5b4

      SHA512

      fa626bd7cabec3c486288b01da738d6c30fc40d6aa200498fa09f3e1e8fceb45edfb8465bb036c336614641fdcc3e59806a01c89003fde29e2549dd7fce8fff5

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk696020.exe

      Filesize

      340KB

      MD5

      cf4fbbd5a2c9d18eb213c9235fca5488

      SHA1

      3b6c02caf775dcedf1b9cdf2586d5bf6871b5f6b

      SHA256

      1d15597e7aa6e4e46abc33b2f9e689b8a812d0365e28faaa653c2fbb84c2d5b4

      SHA512

      fa626bd7cabec3c486288b01da738d6c30fc40d6aa200498fa09f3e1e8fceb45edfb8465bb036c336614641fdcc3e59806a01c89003fde29e2549dd7fce8fff5

    • memory/1448-219-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-234-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-997-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-996-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-995-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-994-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-992-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-197-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-991-0x000000000A440000-0x000000000A47C000-memory.dmp

      Filesize

      240KB

    • memory/1448-990-0x000000000A320000-0x000000000A42A000-memory.dmp

      Filesize

      1.0MB

    • memory/1448-989-0x000000000A300000-0x000000000A312000-memory.dmp

      Filesize

      72KB

    • memory/1448-195-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-237-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-236-0x0000000007350000-0x0000000007360000-memory.dmp

      Filesize

      64KB

    • memory/1448-193-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-201-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-232-0x0000000002CE0000-0x0000000002D26000-memory.dmp

      Filesize

      280KB

    • memory/1448-223-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-221-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-217-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-215-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-211-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-213-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-209-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-207-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-192-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-205-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-988-0x0000000009C90000-0x000000000A2A8000-memory.dmp

      Filesize

      6.1MB

    • memory/1448-203-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/1448-199-0x0000000007180000-0x00000000071B5000-memory.dmp

      Filesize

      212KB

    • memory/4116-174-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-160-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-151-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/4116-149-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/4116-150-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/4116-186-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/4116-184-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/4116-183-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/4116-182-0x00000000072B0000-0x00000000072C0000-memory.dmp

      Filesize

      64KB

    • memory/4116-148-0x0000000002F20000-0x0000000002F4D000-memory.dmp

      Filesize

      180KB

    • memory/4116-181-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/4116-180-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-178-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-176-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-172-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-170-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-168-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-166-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-164-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-162-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-158-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-156-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-154-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-153-0x0000000007240000-0x0000000007253000-memory.dmp

      Filesize

      76KB

    • memory/4116-152-0x00000000072C0000-0x0000000007864000-memory.dmp

      Filesize

      5.6MB