Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    181s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 22:01

General

  • Target

    576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe

  • Size

    562KB

  • MD5

    6d88965f4484398951970344837363f8

  • SHA1

    fec55bcf9c071c6a38d6a8eabafb39fb5dc654d4

  • SHA256

    576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59

  • SHA512

    54263ba5c9da5f4456a5d2baf1f9f3781ab84c681e04942233c90cfd4f398061592cb0f40e7e1fdc12fa94389a62745c48032a30a26569c852a367f4f1941896

  • SSDEEP

    12288:Hy90SyDk5J4dZz/AmaLEOkoVsoFzI/7KJDhSgi:HyVygfw/YQVE/FM2Z7i

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe
    "C:\Users\Admin\AppData\Local\Temp\576b363c58966498acde28dd962e65af53ae0555d8b7903807c826864e399c59.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1480
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5088

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe

    Filesize

    408KB

    MD5

    b0f544026ac1efb4e78fdf207e92f70b

    SHA1

    374b036579ea74abf7d436ff017ef432fdeb3587

    SHA256

    852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe

    SHA512

    761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st673337.exe

    Filesize

    408KB

    MD5

    b0f544026ac1efb4e78fdf207e92f70b

    SHA1

    374b036579ea74abf7d436ff017ef432fdeb3587

    SHA256

    852e829a51ac10ebce3052da7db8c6fcd4582b34dcd320e875863898236ac8fe

    SHA512

    761abfe3732c5638d9963f83b0d2c27c890f6d2876d952443cc8b05bc56678d5bd9d51eb69d5b67c567d0cf8a6e6a8d8c54f54c1922b6667006ae37b421c87b2

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\84334617.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp678488.exe

    Filesize

    360KB

    MD5

    2a5caeeded3331a633e4e2a282ebb4a0

    SHA1

    ec5d990bf6c4afe4908f87588311631b0629f72f

    SHA256

    2441bbdc3404d50081578b810e2335e7ba50a6e4991051dacb71cf32847c35e3

    SHA512

    006d83f4ab9f6eded3eccb1f2d9ca651cf69861f2c78bbf8bef3f4ba6927197391707455eab4fab63c68dc933341806a2b649bf218bb5e2b19f7260ac85c1c7a

  • memory/1480-147-0x0000000000890000-0x000000000089A000-memory.dmp

    Filesize

    40KB

  • memory/5088-153-0x0000000002D10000-0x0000000002D56000-memory.dmp

    Filesize

    280KB

  • memory/5088-154-0x0000000000400000-0x0000000002BC3000-memory.dmp

    Filesize

    39.8MB

  • memory/5088-156-0x00000000073C0000-0x0000000007964000-memory.dmp

    Filesize

    5.6MB

  • memory/5088-158-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB

  • memory/5088-157-0x0000000002D10000-0x0000000002D56000-memory.dmp

    Filesize

    280KB

  • memory/5088-159-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB

  • memory/5088-160-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-161-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-163-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-165-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-167-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-169-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-171-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-173-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-175-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-177-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-179-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-181-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-183-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-185-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-187-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-189-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-191-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-193-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-195-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-197-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-199-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-201-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-203-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-205-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-207-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-209-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-211-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-213-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-215-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-217-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-219-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-221-0x00000000072D0000-0x0000000007305000-memory.dmp

    Filesize

    212KB

  • memory/5088-952-0x0000000009DF0000-0x000000000A408000-memory.dmp

    Filesize

    6.1MB

  • memory/5088-953-0x000000000A460000-0x000000000A472000-memory.dmp

    Filesize

    72KB

  • memory/5088-954-0x000000000A480000-0x000000000A58A000-memory.dmp

    Filesize

    1.0MB

  • memory/5088-955-0x000000000A5A0000-0x000000000A5DC000-memory.dmp

    Filesize

    240KB

  • memory/5088-956-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB

  • memory/5088-958-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB

  • memory/5088-959-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB

  • memory/5088-960-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB

  • memory/5088-961-0x00000000073B0000-0x00000000073C0000-memory.dmp

    Filesize

    64KB