Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:35

General

  • Target

    42c2ff8f6316910b743cd7dac58e90856bff49a76476cc9f586546bc80e01474.exe

  • Size

    696KB

  • MD5

    06322ccfc811753144f7b2bb0d0be5d8

  • SHA1

    285f90d5930fafdc8104f41d99a339de1ffab6d3

  • SHA256

    42c2ff8f6316910b743cd7dac58e90856bff49a76476cc9f586546bc80e01474

  • SHA512

    4546c7055a9244ddd7b6f6fbec9302a504115a9c8ed3688f2c51413c6f9722f5b13e25c50e1e47bcb347b838b1340559501048bd85dab9d3b42b0e10d457e8ab

  • SSDEEP

    12288:5y90YadHFfqsSVNSWgId8CzMENiQrdGyXQYF15iVyxkh6qnSbZe946JRY8gA:5ysdlitVNF5nQENyy5kEbZC46jjZ

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42c2ff8f6316910b743cd7dac58e90856bff49a76476cc9f586546bc80e01474.exe
    "C:\Users\Admin\AppData\Local\Temp\42c2ff8f6316910b743cd7dac58e90856bff49a76476cc9f586546bc80e01474.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un386608.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un386608.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2844
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\70960679.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\70960679.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3716
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 1092
          4⤵
          • Program crash
          PID:2160
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk514213.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk514213.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3440
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 3716 -ip 3716
    1⤵
      PID:4820

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un386608.exe

      Filesize

      542KB

      MD5

      432c6ba1ce4df40a15edfa183f2e4616

      SHA1

      ded27e06a30de59512622d2f0417b26c4f439f6e

      SHA256

      c61e42840355ca6e3569f4e5ef091ea95a3db4d0e0929e8e5de78109b5d7ba3c

      SHA512

      3ac61a21ddcaff2d685f0c8bdc41058364dbdb829c60d4132fdea5ae471310e6eb14dd05604502cf6228155765d3ffebaa5ad0ed0e6ce8ecc18c163845d4b6fe

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un386608.exe

      Filesize

      542KB

      MD5

      432c6ba1ce4df40a15edfa183f2e4616

      SHA1

      ded27e06a30de59512622d2f0417b26c4f439f6e

      SHA256

      c61e42840355ca6e3569f4e5ef091ea95a3db4d0e0929e8e5de78109b5d7ba3c

      SHA512

      3ac61a21ddcaff2d685f0c8bdc41058364dbdb829c60d4132fdea5ae471310e6eb14dd05604502cf6228155765d3ffebaa5ad0ed0e6ce8ecc18c163845d4b6fe

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\70960679.exe

      Filesize

      257KB

      MD5

      dd53d34bf55a47725d539c280c49e5cf

      SHA1

      fa950535eb26d2ff53c82edaca0a8ff2c2f24dbc

      SHA256

      82bea492b057be5ad0d5a54d92182540f52f06b0c1313722185eba94d9bb52f5

      SHA512

      d96837dd359be34683691932ee6b93f3cb19a281562a2ad1ef496b046a6aed2b68771e46699e4db05cf206c063b229e2afe5b47d476cbeffcaf96894f1ab2351

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\70960679.exe

      Filesize

      257KB

      MD5

      dd53d34bf55a47725d539c280c49e5cf

      SHA1

      fa950535eb26d2ff53c82edaca0a8ff2c2f24dbc

      SHA256

      82bea492b057be5ad0d5a54d92182540f52f06b0c1313722185eba94d9bb52f5

      SHA512

      d96837dd359be34683691932ee6b93f3cb19a281562a2ad1ef496b046a6aed2b68771e46699e4db05cf206c063b229e2afe5b47d476cbeffcaf96894f1ab2351

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk514213.exe

      Filesize

      340KB

      MD5

      e75f9e7f3e28becdc3141738ce721f09

      SHA1

      79069ef970bd998518b14da4e2e27aa19295aa4d

      SHA256

      130f84da3288e4a0b4b390101030320f702c08a08dd746b904bfff00cbcee27f

      SHA512

      e7fe036035be6d89d49c621f0cef11234800d4a1d467538290d150b55995b9263c8a27b96d07e72ab33ec37a6c90835d621f8773e407a2fd207298bbfd808596

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk514213.exe

      Filesize

      340KB

      MD5

      e75f9e7f3e28becdc3141738ce721f09

      SHA1

      79069ef970bd998518b14da4e2e27aa19295aa4d

      SHA256

      130f84da3288e4a0b4b390101030320f702c08a08dd746b904bfff00cbcee27f

      SHA512

      e7fe036035be6d89d49c621f0cef11234800d4a1d467538290d150b55995b9263c8a27b96d07e72ab33ec37a6c90835d621f8773e407a2fd207298bbfd808596

    • memory/3440-535-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-221-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-996-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-995-0x000000000A440000-0x000000000A47C000-memory.dmp

      Filesize

      240KB

    • memory/3440-994-0x000000000A320000-0x000000000A42A000-memory.dmp

      Filesize

      1.0MB

    • memory/3440-993-0x000000000A300000-0x000000000A312000-memory.dmp

      Filesize

      72KB

    • memory/3440-992-0x0000000009C70000-0x000000000A288000-memory.dmp

      Filesize

      6.1MB

    • memory/3440-538-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-999-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-537-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-201-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-533-0x0000000002D00000-0x0000000002D46000-memory.dmp

      Filesize

      280KB

    • memory/3440-223-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-998-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-219-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-217-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-215-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-213-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-211-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-209-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-207-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-205-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-203-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-1000-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-1001-0x00000000071F0000-0x0000000007200000-memory.dmp

      Filesize

      64KB

    • memory/3440-196-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-197-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3440-199-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3716-163-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-190-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/3716-188-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3716-187-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3716-185-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-183-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-181-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-179-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-177-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-175-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-173-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-171-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-169-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-167-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-165-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-161-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-159-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-158-0x0000000004C30000-0x0000000004C43000-memory.dmp

      Filesize

      76KB

    • memory/3716-157-0x00000000073D0000-0x0000000007974000-memory.dmp

      Filesize

      5.6MB

    • memory/3716-156-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3716-155-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3716-153-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3716-150-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/3716-149-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3716-148-0x0000000002BE0000-0x0000000002C0D000-memory.dmp

      Filesize

      180KB