Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:52

General

  • Target

    5038d752f11fb5e2cb248bd70f6d85a4fb7e7afe3abf0c366303f971f04739d6.exe

  • Size

    1.1MB

  • MD5

    d33634fb0e99475b2b5f3309dd46ee57

  • SHA1

    d4c5a7db4a2dd7a832a9ccdf774b0000e785fee3

  • SHA256

    5038d752f11fb5e2cb248bd70f6d85a4fb7e7afe3abf0c366303f971f04739d6

  • SHA512

    3b1840c346da67a815f1781be6a01a6d0ffc1e4ad7df0e2672cbe362fd220f640d6e3a744aa5ace043a85285e0db5d51c398e9c7929b081507043b71377a80f7

  • SSDEEP

    24576:FypMtpV4x/fy/b8XftHvBZcCTdBACKl3RqyuFpK3qaNecz5tO7yNhVIveS:FyWVk6/b8tH5ZrTxxyMp4VNr5hVge

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5038d752f11fb5e2cb248bd70f6d85a4fb7e7afe3abf0c366303f971f04739d6.exe
    "C:\Users\Admin\AppData\Local\Temp\5038d752f11fb5e2cb248bd70f6d85a4fb7e7afe3abf0c366303f971f04739d6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4452
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1944
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4512
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4512 -s 1044
            5⤵
            • Program crash
            PID:3060
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4512 -ip 4512
    1⤵
      PID:4700

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe

      Filesize

      719KB

      MD5

      d65c8e9f391cf20655232c5c987b746f

      SHA1

      bfce684cea9f3ad1f8319e3dd581f58ec22df410

      SHA256

      0376e92c9fdd3170bd6c4589d0ab56494bbef6ebb0c1ec8c2be1ea0c637281dc

      SHA512

      226c17e238df5c15eb0a90d5e6922f131e45daa44bee1d7dffe934068cb0db54e03fb23d45826e6daf21f5251bc1cfa65948f19dc45c4c9099376f724e342597

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ut865216.exe

      Filesize

      719KB

      MD5

      d65c8e9f391cf20655232c5c987b746f

      SHA1

      bfce684cea9f3ad1f8319e3dd581f58ec22df410

      SHA256

      0376e92c9fdd3170bd6c4589d0ab56494bbef6ebb0c1ec8c2be1ea0c637281dc

      SHA512

      226c17e238df5c15eb0a90d5e6922f131e45daa44bee1d7dffe934068cb0db54e03fb23d45826e6daf21f5251bc1cfa65948f19dc45c4c9099376f724e342597

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe

      Filesize

      548KB

      MD5

      79bb8aa7f82a94ba01dc4b70c63957e0

      SHA1

      535a7c0407de96fdce4bf3017f07b4333e9acc01

      SHA256

      337c493481660ea88e0c92612f9caafff009cf7820f9fb84746b24ed2b64fff9

      SHA512

      c7adba7203490aee60aa1b678632df1b1b168f47810bc927978f9b8b7e8ace467446c58f8ae85f3f5bbd3fa4cbae2ace32f67b893c02282de618878b98b50139

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\iY640225.exe

      Filesize

      548KB

      MD5

      79bb8aa7f82a94ba01dc4b70c63957e0

      SHA1

      535a7c0407de96fdce4bf3017f07b4333e9acc01

      SHA256

      337c493481660ea88e0c92612f9caafff009cf7820f9fb84746b24ed2b64fff9

      SHA512

      c7adba7203490aee60aa1b678632df1b1b168f47810bc927978f9b8b7e8ace467446c58f8ae85f3f5bbd3fa4cbae2ace32f67b893c02282de618878b98b50139

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe

      Filesize

      278KB

      MD5

      e1b364b4b96ca742b39a069ca1390a0b

      SHA1

      970e15712c7b43117b2144d2dbf2aed590fff249

      SHA256

      dc2f6a4b3d395642bdd40c133807093078b2e6b7f4e683a878d63e258d58cb4b

      SHA512

      4b48624e84da9949c79e3116f9327cd1f1cd1a68cf495db1c7203db470fc668afca3f48674fc47244e6d6e9157a0d3adaa22183a20470a57df1c5f4a31f8573d

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\106888316.exe

      Filesize

      278KB

      MD5

      e1b364b4b96ca742b39a069ca1390a0b

      SHA1

      970e15712c7b43117b2144d2dbf2aed590fff249

      SHA256

      dc2f6a4b3d395642bdd40c133807093078b2e6b7f4e683a878d63e258d58cb4b

      SHA512

      4b48624e84da9949c79e3116f9327cd1f1cd1a68cf495db1c7203db470fc668afca3f48674fc47244e6d6e9157a0d3adaa22183a20470a57df1c5f4a31f8573d

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe

      Filesize

      360KB

      MD5

      848ce28183931ae67c8a0d8ce3a1efc3

      SHA1

      a39582bf82be42b8cf83b0015130273ab0e51c90

      SHA256

      1920e51f6e64752f4dd7474638b8d86c646e1b8cc4099415d2319d038fe1aff3

      SHA512

      430e793cac623274f0082eaec2377e946d9238f394837272ea4237ef305a00b3db28c081d6c82d2fbcadab0dc5a11769ebd9423e9129279a91ffe4b7aeae4b1d

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\258768145.exe

      Filesize

      360KB

      MD5

      848ce28183931ae67c8a0d8ce3a1efc3

      SHA1

      a39582bf82be42b8cf83b0015130273ab0e51c90

      SHA256

      1920e51f6e64752f4dd7474638b8d86c646e1b8cc4099415d2319d038fe1aff3

      SHA512

      430e793cac623274f0082eaec2377e946d9238f394837272ea4237ef305a00b3db28c081d6c82d2fbcadab0dc5a11769ebd9423e9129279a91ffe4b7aeae4b1d

    • memory/1644-1012-0x000000000A320000-0x000000000A332000-memory.dmp

      Filesize

      72KB

    • memory/1644-226-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-1019-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-1018-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-1015-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-1014-0x000000000A460000-0x000000000A49C000-memory.dmp

      Filesize

      240KB

    • memory/1644-216-0x0000000002D10000-0x0000000002D56000-memory.dmp

      Filesize

      280KB

    • memory/1644-1013-0x000000000A340000-0x000000000A44A000-memory.dmp

      Filesize

      1.0MB

    • memory/1644-1021-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-1011-0x0000000009C60000-0x000000000A278000-memory.dmp

      Filesize

      6.1MB

    • memory/1644-631-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-629-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-234-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-232-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-230-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-228-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-1020-0x0000000002FB0000-0x0000000002FC0000-memory.dmp

      Filesize

      64KB

    • memory/1644-224-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-222-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-220-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-217-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/1644-218-0x0000000007730000-0x0000000007765000-memory.dmp

      Filesize

      212KB

    • memory/2380-134-0x0000000002670000-0x000000000274D000-memory.dmp

      Filesize

      884KB

    • memory/2380-139-0x0000000000400000-0x00000000008BD000-memory.dmp

      Filesize

      4.7MB

    • memory/4512-167-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/4512-205-0x0000000000400000-0x0000000002BAF000-memory.dmp

      Filesize

      39.7MB

    • memory/4512-196-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-198-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-194-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-192-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-190-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-188-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-186-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-180-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-182-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-184-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-178-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-176-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-174-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-172-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-171-0x0000000004BD0000-0x0000000004BE2000-memory.dmp

      Filesize

      72KB

    • memory/4512-169-0x0000000007180000-0x0000000007724000-memory.dmp

      Filesize

      5.6MB

    • memory/4512-168-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/4512-166-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/4512-164-0x0000000000400000-0x0000000002BAF000-memory.dmp

      Filesize

      39.7MB

    • memory/4512-162-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/4512-161-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/4512-160-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/4512-159-0x0000000002DF0000-0x0000000002E1D000-memory.dmp

      Filesize

      180KB