Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 20:38 UTC

General

  • Target

    fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9.exe

  • Size

    690KB

  • MD5

    8cb991d44f83950d56b05c5513480254

  • SHA1

    91861e9496f01a1681d9c1239f3ac4d7803c6883

  • SHA256

    fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9

  • SHA512

    75e97aa1adc0a96f21816fee16a821fbd2e10921f0a989eb509274284da2b8017758e76369829438d1e25e8bc288d1b4536c2320258c7ae5b00fe8a84eab5336

  • SSDEEP

    12288:3y90dmJsQJUcyKb+/83yb1E/VIE80qKR2ymJOD7zLSvuH:3yrOc7+QdIZk2ycO//H

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9.exe
    "C:\Users\Admin\AppData\Local\Temp\fcf6613a3454512e24632047ce20c9ad3098ac76511b2f2abc68d42c4667b0e9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1172
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 1080
          4⤵
          • Program crash
          PID:1620
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1080
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1172 -ip 1172
    1⤵
      PID:760

    Network

    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      68.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.77.109.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.77.109.52.in-addr.arpa
      IN PTR
      Response
    • 20.190.159.0:443
      260 B
      5
    • 185.161.248.143:38452
      rk139230.exe
      260 B
      5
    • 52.242.101.226:443
      260 B
      5
    • 51.11.192.49:443
      322 B
      7
    • 185.161.248.143:38452
      rk139230.exe
      260 B
      5
    • 173.223.113.164:443
      322 B
      7
    • 204.79.197.203:80
      322 B
      7
    • 52.242.101.226:443
      260 B
      5
    • 8.238.177.126:80
      322 B
      7
    • 185.161.248.143:38452
      rk139230.exe
      260 B
      5
    • 52.242.101.226:443
      260 B
      5
    • 185.161.248.143:38452
      rk139230.exe
      260 B
      5
    • 52.242.101.226:443
      260 B
      5
    • 185.161.248.143:38452
      rk139230.exe
      260 B
      5
    • 52.242.101.226:443
      260 B
      5
    • 185.161.248.143:38452
      rk139230.exe
      260 B
      5
    • 52.242.101.226:443
      208 B
      4
    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      68.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      68.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      1.77.109.52.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      1.77.109.52.in-addr.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe

      Filesize

      536KB

      MD5

      5b573a4889bcbb8b0ad137a2fd9ec438

      SHA1

      4ea6de70e2655e92864e229e5aa6c833d214a907

      SHA256

      efec0406db2fe14f8c3e976c0ff96a7acd01cfb7b7ccf5bba8e26498659e81ea

      SHA512

      1c9ff76d42095f0c2951643e01edf91d27290c69c6b55fae6f08cdd7bbc6c92929fb81f4e881c543de0ecc46765a9d16dc27fa01ecb9e8e6026dd111ae782231

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un302444.exe

      Filesize

      536KB

      MD5

      5b573a4889bcbb8b0ad137a2fd9ec438

      SHA1

      4ea6de70e2655e92864e229e5aa6c833d214a907

      SHA256

      efec0406db2fe14f8c3e976c0ff96a7acd01cfb7b7ccf5bba8e26498659e81ea

      SHA512

      1c9ff76d42095f0c2951643e01edf91d27290c69c6b55fae6f08cdd7bbc6c92929fb81f4e881c543de0ecc46765a9d16dc27fa01ecb9e8e6026dd111ae782231

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe

      Filesize

      259KB

      MD5

      086fdf0ed9298523e0e464c697a83d9b

      SHA1

      f01b5e2a786ee2dd6d9c4b5b6d0e4eabe97d87c1

      SHA256

      c6f2cc98fa6815449d730618fa1ef41a81a0fe7bdebcc5f41b11a22d1ce5839a

      SHA512

      c4849d796beb812eeddbb984976c6bf9350ac0822c0ed49fb332909fb094943c9485d4147eedbc2ab95e9ded09f9dc91c0233a88a5d6baa813eb3988704b2091

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\94857262.exe

      Filesize

      259KB

      MD5

      086fdf0ed9298523e0e464c697a83d9b

      SHA1

      f01b5e2a786ee2dd6d9c4b5b6d0e4eabe97d87c1

      SHA256

      c6f2cc98fa6815449d730618fa1ef41a81a0fe7bdebcc5f41b11a22d1ce5839a

      SHA512

      c4849d796beb812eeddbb984976c6bf9350ac0822c0ed49fb332909fb094943c9485d4147eedbc2ab95e9ded09f9dc91c0233a88a5d6baa813eb3988704b2091

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe

      Filesize

      341KB

      MD5

      661c757d3f34b1ada0fef0b536f263fc

      SHA1

      66d9cc199fe247540d730db57eaeab7fea3c6cc2

      SHA256

      02d5a4364bb851f2688b58b60d56b009f0b2c50c3cdce9be505842a11dcce7c0

      SHA512

      acb6f126a66d2aa7abaf65cecf5c3e29c1ff9b4f7f6c49e0a2794123383fc0fe55374d848ae522d6a0212318020f08bf962ba894ab3dd5e36e78a32ddd6ff5f2

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk139230.exe

      Filesize

      341KB

      MD5

      661c757d3f34b1ada0fef0b536f263fc

      SHA1

      66d9cc199fe247540d730db57eaeab7fea3c6cc2

      SHA256

      02d5a4364bb851f2688b58b60d56b009f0b2c50c3cdce9be505842a11dcce7c0

      SHA512

      acb6f126a66d2aa7abaf65cecf5c3e29c1ff9b4f7f6c49e0a2794123383fc0fe55374d848ae522d6a0212318020f08bf962ba894ab3dd5e36e78a32ddd6ff5f2

    • memory/1080-216-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-220-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-991-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-990-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-989-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-987-0x0000000007D10000-0x0000000007D4C000-memory.dmp

      Filesize

      240KB

    • memory/1080-986-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-985-0x0000000007C00000-0x0000000007D0A000-memory.dmp

      Filesize

      1.0MB

    • memory/1080-194-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-983-0x00000000075E0000-0x0000000007BF8000-memory.dmp

      Filesize

      6.1MB

    • memory/1080-379-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-376-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-377-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

      Filesize

      64KB

    • memory/1080-374-0x0000000000730000-0x0000000000776000-memory.dmp

      Filesize

      280KB

    • memory/1080-192-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-218-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-196-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-212-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-210-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-208-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-206-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-188-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-187-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-190-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-204-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-984-0x0000000004B70000-0x0000000004B82000-memory.dmp

      Filesize

      72KB

    • memory/1080-214-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-198-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-200-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1080-202-0x0000000004AB0000-0x0000000004AE5000-memory.dmp

      Filesize

      212KB

    • memory/1172-171-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-175-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-149-0x0000000002450000-0x0000000002460000-memory.dmp

      Filesize

      64KB

    • memory/1172-182-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/1172-180-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/1172-179-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-148-0x0000000000600000-0x000000000062D000-memory.dmp

      Filesize

      180KB

    • memory/1172-177-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-169-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-151-0x0000000004A30000-0x0000000004FD4000-memory.dmp

      Filesize

      5.6MB

    • memory/1172-150-0x0000000002450000-0x0000000002460000-memory.dmp

      Filesize

      64KB

    • memory/1172-167-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-173-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-165-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-163-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-161-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-159-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-155-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-157-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-153-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    • memory/1172-152-0x0000000002580000-0x0000000002593000-memory.dmp

      Filesize

      76KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.