Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2023, 22:26
Static task
static1
Behavioral task
behavioral1
Sample
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
Resource
win10v2004-20230220-en
General
-
Target
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe
-
Size
746KB
-
MD5
d183bc9483a7ec12de8f2cb69970caaf
-
SHA1
bc03c966cb9c0c6b67470b9f96e9b32bede5baf8
-
SHA256
6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113
-
SHA512
f3fff1b785a9cccfdc91721671304f6eb1dcf68271f7b905783b86a4b4fac7509cc1dc9225d3d0c137b252f06c52fc56a656911421f6513c5b556ba06fb02cc4
-
SSDEEP
12288:Ty90UocgjXqtikQCcjvsEyVadGB9HSuPZn5RN6JlD4nNPhEhdgak:Ty9MnLsEfGB9HSIR5/egNPhEhk
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/4528-989-0x00000000078B0000-0x0000000007EC8000-memory.dmp redline_stealer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 90416643.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 1964 un770582.exe 4480 90416643.exe 4528 rk085069.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 90416643.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 90416643.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un770582.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un770582.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 3852 4480 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4480 90416643.exe 4480 90416643.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4480 90416643.exe Token: SeDebugPrivilege 4528 rk085069.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 452 wrote to memory of 1964 452 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 84 PID 452 wrote to memory of 1964 452 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 84 PID 452 wrote to memory of 1964 452 6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe 84 PID 1964 wrote to memory of 4480 1964 un770582.exe 85 PID 1964 wrote to memory of 4480 1964 un770582.exe 85 PID 1964 wrote to memory of 4480 1964 un770582.exe 85 PID 1964 wrote to memory of 4528 1964 un770582.exe 91 PID 1964 wrote to memory of 4528 1964 un770582.exe 91 PID 1964 wrote to memory of 4528 1964 un770582.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe"C:\Users\Admin\AppData\Local\Temp\6e3eebd9d6a0e53094f95b2029a6384727555b13ee0c59a057928d6018dc4113.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un770582.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\90416643.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 10364⤵
- Program crash
PID:3852
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk085069.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4480 -ip 44801⤵PID:4600
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD553b92ed577466e6a642d9d33b16d907f
SHA1df0e86a4e15fb200a7f5b2088a05f41ae5ef1880
SHA256d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172
SHA51284a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e
-
Filesize
592KB
MD553b92ed577466e6a642d9d33b16d907f
SHA1df0e86a4e15fb200a7f5b2088a05f41ae5ef1880
SHA256d8171ae70ff0b9d31b4639fcc3133478a7506ac45974a2fd8222f9732e85f172
SHA51284a1fc996b6996b33dbb97306e6aa00e109b023df2780d56a26757d1504ce771b704ec1dfa713c53473326dddcc405f1193e18bbeaa1829cacd264ccfb0d564e
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
377KB
MD5e89018d24e0e3266dc15a5a50ddcfe55
SHA12b3a21da39b6febb466cfe947f290fa4902f7359
SHA2568b8cfd970fead813049abdac74ed3ef66fe7dddd983816898bb977350d1c1592
SHA5128a32fc82562f1d16b364cc5692cf9972b0e27af0d1226ba555545360a12c211a10b1f84da567bc0d4844296315920df25b94df85081bc076cc3e0fafe5bb0dd6
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240
-
Filesize
459KB
MD553edd6b08f2c312735b59eb48f99e1a2
SHA149157b5324220d33e031ba7c3d0a04dd5b66f5ac
SHA2560c0242fc83e6d4fec9e8f76cacc3ca3fa792a86a398d503eb361bef1ce8fc0c6
SHA512a5f7da3a79b69a5c08e95d5688b66b4fc469ad3457a2c2dad446a2e72133d0fa78c6a17092c6b8752056094640df49544b2b650d4041a7640a39cb2c31ab0240