Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 22:25

General

  • Target

    6d407a2523b0cb6b61fd58dcaf8f4f68fde833dc81d100011423211d2439e3d9.exe

  • Size

    690KB

  • MD5

    c7ab0dfa09afc1aacc39af792090052b

  • SHA1

    3a20067dff58b476ce6b3fba3ed551d6d0a19438

  • SHA256

    6d407a2523b0cb6b61fd58dcaf8f4f68fde833dc81d100011423211d2439e3d9

  • SHA512

    c056825909e60ae2862cca8bda46bb302fd31837c96d759b03395656edd0f5a782cd0807490f0a4758db17829349ebc01dac54b0df217eace5557f0c30b2dd12

  • SSDEEP

    12288:Wy90erFygb3dfQykHWF/czVYfW/O8n8uGDIHXjzzpQFPR:WyfrFygbGbHWceWD8uGsHXPzSR

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6d407a2523b0cb6b61fd58dcaf8f4f68fde833dc81d100011423211d2439e3d9.exe
    "C:\Users\Admin\AppData\Local\Temp\6d407a2523b0cb6b61fd58dcaf8f4f68fde833dc81d100011423211d2439e3d9.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un805149.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un805149.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2152
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\17096008.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\17096008.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3204
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 1080
          4⤵
          • Program crash
          PID:784
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977136.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977136.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2104
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3204 -ip 3204
    1⤵
      PID:3336

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un805149.exe

      Filesize

      536KB

      MD5

      8eb75e6baae062bf2cb8127821fb60d9

      SHA1

      1c8c1509866e4ac5794d0dd04140b42a655f0734

      SHA256

      d2811ed518c66fd3a4cbbfdcc5c9c92fbab7aef8257832be64a481fcf3a6fad1

      SHA512

      9d973161e72ab3d15f52f3e1d8a3ad3c053fbcc4b02477dd747d4fb65f769b9820d1c38497a2d5e5bd0eb31279891d466b58b6dca9d1578cfacb21ad5ee9089d

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un805149.exe

      Filesize

      536KB

      MD5

      8eb75e6baae062bf2cb8127821fb60d9

      SHA1

      1c8c1509866e4ac5794d0dd04140b42a655f0734

      SHA256

      d2811ed518c66fd3a4cbbfdcc5c9c92fbab7aef8257832be64a481fcf3a6fad1

      SHA512

      9d973161e72ab3d15f52f3e1d8a3ad3c053fbcc4b02477dd747d4fb65f769b9820d1c38497a2d5e5bd0eb31279891d466b58b6dca9d1578cfacb21ad5ee9089d

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\17096008.exe

      Filesize

      258KB

      MD5

      4669a11cd7aef374c63512c330bc6509

      SHA1

      6bee14310e8cf66955cb8392eeaa1ca936cb3126

      SHA256

      b129c02bf0b5ba073a4001ec057aaa998af61d71cf7854c29f6c41d6f1a02021

      SHA512

      05a68ca77ec8bbf6696c613b0ce484ef0a06547db83be855cb9d3cd8939bb5833b6348d669d95261544b696dfc5a35ec29071880eee27583c91ea1fc4110b5ce

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\17096008.exe

      Filesize

      258KB

      MD5

      4669a11cd7aef374c63512c330bc6509

      SHA1

      6bee14310e8cf66955cb8392eeaa1ca936cb3126

      SHA256

      b129c02bf0b5ba073a4001ec057aaa998af61d71cf7854c29f6c41d6f1a02021

      SHA512

      05a68ca77ec8bbf6696c613b0ce484ef0a06547db83be855cb9d3cd8939bb5833b6348d669d95261544b696dfc5a35ec29071880eee27583c91ea1fc4110b5ce

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977136.exe

      Filesize

      342KB

      MD5

      2325b16d2fb21cd5009e2e0b1347b6c3

      SHA1

      f0b3b049ec5c26b9ebe0b33465e33d0c9fdee0b0

      SHA256

      1e09ed9c9aedc43a62e4aa6842befd51df78122607c2cc99b00b7a2e8029fb27

      SHA512

      142d9d6bd7b4fd614ecf4bf0865b37b7153b6fc4a9399868e326d5b24d699ea3ec984456798f451ff2b589124ed36fad984637989120c6ccd37535f7854a5aee

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk977136.exe

      Filesize

      342KB

      MD5

      2325b16d2fb21cd5009e2e0b1347b6c3

      SHA1

      f0b3b049ec5c26b9ebe0b33465e33d0c9fdee0b0

      SHA256

      1e09ed9c9aedc43a62e4aa6842befd51df78122607c2cc99b00b7a2e8029fb27

      SHA512

      142d9d6bd7b4fd614ecf4bf0865b37b7153b6fc4a9399868e326d5b24d699ea3ec984456798f451ff2b589124ed36fad984637989120c6ccd37535f7854a5aee

    • memory/2104-219-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-360-0x00000000005C0000-0x0000000000606000-memory.dmp

      Filesize

      280KB

    • memory/2104-996-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-995-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-994-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-993-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-991-0x0000000004B90000-0x0000000004BCC000-memory.dmp

      Filesize

      240KB

    • memory/2104-195-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-989-0x0000000007C60000-0x0000000007D6A000-memory.dmp

      Filesize

      1.0MB

    • memory/2104-197-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-988-0x0000000004B60000-0x0000000004B72000-memory.dmp

      Filesize

      72KB

    • memory/2104-987-0x0000000007640000-0x0000000007C58000-memory.dmp

      Filesize

      6.1MB

    • memory/2104-363-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-362-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-193-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-199-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-223-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-221-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-217-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-215-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-213-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-211-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-209-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-207-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-205-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-192-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-203-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/2104-990-0x0000000004C00000-0x0000000004C10000-memory.dmp

      Filesize

      64KB

    • memory/2104-201-0x0000000002300000-0x0000000002335000-memory.dmp

      Filesize

      212KB

    • memory/3204-174-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-164-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-151-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/3204-149-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/3204-150-0x0000000004D00000-0x00000000052A4000-memory.dmp

      Filesize

      5.6MB

    • memory/3204-186-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/3204-184-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/3204-183-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/3204-182-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB

    • memory/3204-181-0x0000000000400000-0x0000000000455000-memory.dmp

      Filesize

      340KB

    • memory/3204-148-0x0000000000570000-0x000000000059D000-memory.dmp

      Filesize

      180KB

    • memory/3204-180-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-178-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-176-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-172-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-170-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-168-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-162-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-166-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-160-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-158-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-156-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-154-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-153-0x0000000002620000-0x0000000002633000-memory.dmp

      Filesize

      76KB

    • memory/3204-152-0x0000000004CF0000-0x0000000004D00000-memory.dmp

      Filesize

      64KB