Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 20:09

General

  • Target

    e294240fa6434a0cdb84f054d6f3aacb8bbdd321bf3848ab1cec6888682bd38e.exe

  • Size

    746KB

  • MD5

    49b87574e7fcd6507d0ea3a35fad6e7a

  • SHA1

    93dea5b563c7860f073f9c8cd0b6d8474381b8b4

  • SHA256

    e294240fa6434a0cdb84f054d6f3aacb8bbdd321bf3848ab1cec6888682bd38e

  • SHA512

    b3cb59eb2f41295c6d9eefdbe3ab9570e52aeec3c7de07dfaaebad9093ae7eafcfefe172c052be03ec06f128f7dbf0508d6d0ded45138e9b0f16aa775ae43a52

  • SSDEEP

    12288:Wy90Vbiezt96fwczrWu6hJCPbiajDfrQBdVIviy/97ZBtyXCvUTLVqTWe1bo8:WySbiS9G7L6hJ0iaPAduvJhyXO/

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e294240fa6434a0cdb84f054d6f3aacb8bbdd321bf3848ab1cec6888682bd38e.exe
    "C:\Users\Admin\AppData\Local\Temp\e294240fa6434a0cdb84f054d6f3aacb8bbdd321bf3848ab1cec6888682bd38e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un931191.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un931191.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:984
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\09447098.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\09447098.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:780
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 780 -s 1088
          4⤵
          • Program crash
          PID:1744
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk640501.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk640501.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2236
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 780 -ip 780
    1⤵
      PID:1964

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un931191.exe

      Filesize

      592KB

      MD5

      63c9f017c876306c8ff61995498e882c

      SHA1

      2001ba403fde1f89f2793d2fda6c580978373bfb

      SHA256

      5a9f88e29d7071a55bd882b6ebd9f33f5765bee5b3d31cdbf7357cf6776d4544

      SHA512

      b17942f30d500cd76a90903af739db33bfcbd222be1f47b3cdcd244e46bc64007ac3c8d1cf96b62e6bca54dcf323fcd6cc9e8aed9b493d41d5406491fce73433

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un931191.exe

      Filesize

      592KB

      MD5

      63c9f017c876306c8ff61995498e882c

      SHA1

      2001ba403fde1f89f2793d2fda6c580978373bfb

      SHA256

      5a9f88e29d7071a55bd882b6ebd9f33f5765bee5b3d31cdbf7357cf6776d4544

      SHA512

      b17942f30d500cd76a90903af739db33bfcbd222be1f47b3cdcd244e46bc64007ac3c8d1cf96b62e6bca54dcf323fcd6cc9e8aed9b493d41d5406491fce73433

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\09447098.exe

      Filesize

      376KB

      MD5

      2d5c72f1c5cda174e052fab8e306541f

      SHA1

      f6de9603a95a37f39128827e8f39f1fe591df31a

      SHA256

      2b751ab7658f4343e5cf33c85e90a5482729b410e7eccf71daeb24d427fa47ce

      SHA512

      f56706a76486cc31a326b7733486f7e9fcdd59c8840fb4fc87a0f33ce2e540b9133cf912fea5eb92965462d5a83a71d27a3bff1729baf65dbd7da3c0312b2e4f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\09447098.exe

      Filesize

      376KB

      MD5

      2d5c72f1c5cda174e052fab8e306541f

      SHA1

      f6de9603a95a37f39128827e8f39f1fe591df31a

      SHA256

      2b751ab7658f4343e5cf33c85e90a5482729b410e7eccf71daeb24d427fa47ce

      SHA512

      f56706a76486cc31a326b7733486f7e9fcdd59c8840fb4fc87a0f33ce2e540b9133cf912fea5eb92965462d5a83a71d27a3bff1729baf65dbd7da3c0312b2e4f

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk640501.exe

      Filesize

      459KB

      MD5

      5791dc2e7400312eedb34b24376e0047

      SHA1

      08870ac8193403fc5a8c95d01ac292dea1733ea0

      SHA256

      11d36f6908c7c8ee43407793c36e41f6e33421f9dbb59158c9aca372a85fca8b

      SHA512

      f1eb32ed068c4158746fb562250ebd505fc74cf397381c75f4650d1c5f6f62adba9f8385761c65cedbebdc7c8c6f58bb0f0c86abfdf34d6a3d7ecab7141fdead

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk640501.exe

      Filesize

      459KB

      MD5

      5791dc2e7400312eedb34b24376e0047

      SHA1

      08870ac8193403fc5a8c95d01ac292dea1733ea0

      SHA256

      11d36f6908c7c8ee43407793c36e41f6e33421f9dbb59158c9aca372a85fca8b

      SHA512

      f1eb32ed068c4158746fb562250ebd505fc74cf397381c75f4650d1c5f6f62adba9f8385761c65cedbebdc7c8c6f58bb0f0c86abfdf34d6a3d7ecab7141fdead

    • memory/780-163-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-150-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/780-152-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

    • memory/780-153-0x0000000004FD0000-0x0000000005574000-memory.dmp

      Filesize

      5.6MB

    • memory/780-154-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-155-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-157-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-159-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-161-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-151-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

    • memory/780-165-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-167-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-169-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-171-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-173-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-175-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-177-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-179-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-181-0x0000000002960000-0x0000000002972000-memory.dmp

      Filesize

      72KB

    • memory/780-182-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

    • memory/780-184-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

    • memory/780-185-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

    • memory/780-187-0x0000000000400000-0x0000000000803000-memory.dmp

      Filesize

      4.0MB

    • memory/780-149-0x00000000025A0000-0x00000000025B0000-memory.dmp

      Filesize

      64KB

    • memory/780-148-0x0000000000910000-0x000000000093D000-memory.dmp

      Filesize

      180KB

    • memory/2236-242-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-221-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-993-0x0000000005040000-0x000000000507C000-memory.dmp

      Filesize

      240KB

    • memory/2236-194-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-201-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-203-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-205-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-207-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-209-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-211-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-213-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-215-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-217-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-195-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-199-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-236-0x0000000000820000-0x0000000000866000-memory.dmp

      Filesize

      280KB

    • memory/2236-219-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-238-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-240-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-991-0x0000000005010000-0x0000000005022000-memory.dmp

      Filesize

      72KB

    • memory/2236-990-0x0000000007A00000-0x0000000008018000-memory.dmp

      Filesize

      6.1MB

    • memory/2236-223-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-992-0x0000000008020000-0x000000000812A000-memory.dmp

      Filesize

      1.0MB

    • memory/2236-197-0x00000000029A0000-0x00000000029D5000-memory.dmp

      Filesize

      212KB

    • memory/2236-994-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-996-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-997-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-998-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB

    • memory/2236-999-0x00000000050C0000-0x00000000050D0000-memory.dmp

      Filesize

      64KB