Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 22:37

General

  • Target

    030a3047053c0951c877033ae7b8394f8889052aa9564ebb65cbaa0b25e41f5c.exe

  • Size

    694KB

  • MD5

    69d4160bbfefda8fd6481b25158fa7f4

  • SHA1

    e498f77d023c2ad95c050c1b90dc3026df5a716e

  • SHA256

    030a3047053c0951c877033ae7b8394f8889052aa9564ebb65cbaa0b25e41f5c

  • SHA512

    a67d52e85242a3049ff540542725795b8c393d69fb9747eee1bed85f3e6f57687305ebda71ee1c259c1729134f1e7c89b7fe2de824862cc5c19dc5297745f77e

  • SSDEEP

    12288:by905RiNpoEioZ6L6J4wpFTUirGfG5eWz6Fp18bSKlA+l+2l0834X:byCR8poey5oFLrGfK6Fp18bSqG2lve

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\030a3047053c0951c877033ae7b8394f8889052aa9564ebb65cbaa0b25e41f5c.exe
    "C:\Users\Admin\AppData\Local\Temp\030a3047053c0951c877033ae7b8394f8889052aa9564ebb65cbaa0b25e41f5c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un054237.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un054237.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\85856717.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\85856717.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 1088
          4⤵
          • Program crash
          PID:1160
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812703.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812703.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3484
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1764 -ip 1764
    1⤵
      PID:3796

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un054237.exe

      Filesize

      540KB

      MD5

      e4fb0a1bc923cce78ad0af1d684f4366

      SHA1

      ba5ed8e805784ae6697fea2b0fb859dbc803bca1

      SHA256

      ccb984c68ffee26a679adf532c80e0721a0e64369dc81689d0073f09f9812b6d

      SHA512

      4259dc63bd6470754fbac868d2e9fe86ec14de9e081a34506e79b10b2526ac1f7ad78cda3fa49e5cb30e2000e81f742d36b018ddfa6370f246a04d8c16066a3b

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un054237.exe

      Filesize

      540KB

      MD5

      e4fb0a1bc923cce78ad0af1d684f4366

      SHA1

      ba5ed8e805784ae6697fea2b0fb859dbc803bca1

      SHA256

      ccb984c68ffee26a679adf532c80e0721a0e64369dc81689d0073f09f9812b6d

      SHA512

      4259dc63bd6470754fbac868d2e9fe86ec14de9e081a34506e79b10b2526ac1f7ad78cda3fa49e5cb30e2000e81f742d36b018ddfa6370f246a04d8c16066a3b

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\85856717.exe

      Filesize

      258KB

      MD5

      323f8fc86af5cb6da06fbca6600c3ac2

      SHA1

      e420f6d593f5e05ca9528f2d75414f8848d03907

      SHA256

      0cdc9c9660bb8b30bf460a5004f937c197688a397377b133dd1a02334d32da17

      SHA512

      e3fb60971288c7c1fb675a87658781b0ff493fd56a4dda0e9441fe41d19f4b582f8212f80c8b43464809df818152cc80d807a6d6237125fc823ab27b6dbea6ff

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\85856717.exe

      Filesize

      258KB

      MD5

      323f8fc86af5cb6da06fbca6600c3ac2

      SHA1

      e420f6d593f5e05ca9528f2d75414f8848d03907

      SHA256

      0cdc9c9660bb8b30bf460a5004f937c197688a397377b133dd1a02334d32da17

      SHA512

      e3fb60971288c7c1fb675a87658781b0ff493fd56a4dda0e9441fe41d19f4b582f8212f80c8b43464809df818152cc80d807a6d6237125fc823ab27b6dbea6ff

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812703.exe

      Filesize

      340KB

      MD5

      e71cf27eca06104a89fbefc4a89fa2b6

      SHA1

      c8d8c67833ebc3007fcec52dcb89297a0ca6621e

      SHA256

      a1d0e2d0640b8fd735b88d26b898a6912f2f62cff3aad35197122950d550eec7

      SHA512

      a18ae4d74663ed0191107e0ec1e6af8eac6480958cbcc26afab665089d13c7a19503f2dca255ee3c2412ad27fcbd132ade157b069750c505ab09b8e4601466d0

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk812703.exe

      Filesize

      340KB

      MD5

      e71cf27eca06104a89fbefc4a89fa2b6

      SHA1

      c8d8c67833ebc3007fcec52dcb89297a0ca6621e

      SHA256

      a1d0e2d0640b8fd735b88d26b898a6912f2f62cff3aad35197122950d550eec7

      SHA512

      a18ae4d74663ed0191107e0ec1e6af8eac6480958cbcc26afab665089d13c7a19503f2dca255ee3c2412ad27fcbd132ade157b069750c505ab09b8e4601466d0

    • memory/1764-163-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-150-0x0000000007220000-0x0000000007230000-memory.dmp

      Filesize

      64KB

    • memory/1764-152-0x0000000007230000-0x00000000077D4000-memory.dmp

      Filesize

      5.6MB

    • memory/1764-153-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/1764-155-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-154-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-157-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-159-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-161-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-151-0x0000000007220000-0x0000000007230000-memory.dmp

      Filesize

      64KB

    • memory/1764-165-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-175-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-173-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-177-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-171-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-179-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-169-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-167-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-181-0x0000000007800000-0x0000000007813000-memory.dmp

      Filesize

      76KB

    • memory/1764-182-0x0000000002C70000-0x0000000002C9D000-memory.dmp

      Filesize

      180KB

    • memory/1764-183-0x0000000007220000-0x0000000007230000-memory.dmp

      Filesize

      64KB

    • memory/1764-184-0x0000000007220000-0x0000000007230000-memory.dmp

      Filesize

      64KB

    • memory/1764-185-0x0000000007220000-0x0000000007230000-memory.dmp

      Filesize

      64KB

    • memory/1764-190-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/1764-149-0x0000000002C70000-0x0000000002C9D000-memory.dmp

      Filesize

      180KB

    • memory/1764-148-0x0000000000400000-0x0000000002B9B000-memory.dmp

      Filesize

      39.6MB

    • memory/3484-251-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-996-0x000000000A440000-0x000000000A47C000-memory.dmp

      Filesize

      240KB

    • memory/3484-197-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-201-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-247-0x0000000002CC0000-0x0000000002D06000-memory.dmp

      Filesize

      280KB

    • memory/3484-205-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-207-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-209-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-211-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-213-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-215-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-217-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-995-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-219-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-203-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-221-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-249-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-253-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-223-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-992-0x0000000009D00000-0x000000000A318000-memory.dmp

      Filesize

      6.1MB

    • memory/3484-993-0x00000000072A0000-0x00000000072B2000-memory.dmp

      Filesize

      72KB

    • memory/3484-994-0x000000000A320000-0x000000000A42A000-memory.dmp

      Filesize

      1.0MB

    • memory/3484-196-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-199-0x0000000007190000-0x00000000071C5000-memory.dmp

      Filesize

      212KB

    • memory/3484-998-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-999-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-1000-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB

    • memory/3484-1001-0x00000000072C0000-0x00000000072D0000-memory.dmp

      Filesize

      64KB