Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2023, 22:40
Static task
static1
Behavioral task
behavioral1
Sample
05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe
Resource
win10v2004-20230220-en
General
-
Target
05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe
-
Size
827KB
-
MD5
25ed799a31a50dd78c1e800abcff108f
-
SHA1
f7efdf941ef9e9b792e057fb6a7f589b329eb57b
-
SHA256
05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663
-
SHA512
d004ba91f80b82fe17a60f9817cd2d4252ff2d76eebe573e884e1ecb535408672eaae626fa24ed179ab37a21e36af35cef25f05c3d1e9100116ad4e0cd827c98
-
SSDEEP
24576:TyhewtCvPdmdIaYqfaFGIfLCpSQHtTltnDxm+N:mhbEdmdIaYqfaBLCpfHtpt9m+
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/2936-957-0x0000000009E10000-0x000000000A428000-memory.dmp redline_stealer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" it025950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" it025950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" it025950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" it025950.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" it025950.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection it025950.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 2252 ziXW9339.exe 2292 ziRC0161.exe 1524 it025950.exe 2936 jr943041.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it025950.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziXW9339.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziXW9339.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ziRC0161.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" ziRC0161.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4972 sc.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1524 it025950.exe 1524 it025950.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1524 it025950.exe Token: SeDebugPrivilege 2936 jr943041.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2252 1636 05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe 84 PID 1636 wrote to memory of 2252 1636 05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe 84 PID 1636 wrote to memory of 2252 1636 05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe 84 PID 2252 wrote to memory of 2292 2252 ziXW9339.exe 85 PID 2252 wrote to memory of 2292 2252 ziXW9339.exe 85 PID 2252 wrote to memory of 2292 2252 ziXW9339.exe 85 PID 2292 wrote to memory of 1524 2292 ziRC0161.exe 86 PID 2292 wrote to memory of 1524 2292 ziRC0161.exe 86 PID 2292 wrote to memory of 2936 2292 ziRC0161.exe 90 PID 2292 wrote to memory of 2936 2292 ziRC0161.exe 90 PID 2292 wrote to memory of 2936 2292 ziRC0161.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe"C:\Users\Admin\AppData\Local\Temp\05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXW9339.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXW9339.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRC0161.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRC0161.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it025950.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it025950.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr943041.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr943041.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:4972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
569KB
MD5b61d614ff9059e171e9b95557a2fd64b
SHA15c0cdf73c8b89c9e7d2b05f1e460e6f429f2f7d8
SHA2564f348bb96fd8b0a9e29447dcfdb89339da662664cab7facf0a7f987aeb8fb1ed
SHA512c12b1a55f2596fa755defb2ab4ed00b102c7514ebfab47c6046b93df6a31fbc4b78e2b5945ba708b156eb1772ea5bf67c2fa3d9b0d997cb3419b8ad2daf23f33
-
Filesize
569KB
MD5b61d614ff9059e171e9b95557a2fd64b
SHA15c0cdf73c8b89c9e7d2b05f1e460e6f429f2f7d8
SHA2564f348bb96fd8b0a9e29447dcfdb89339da662664cab7facf0a7f987aeb8fb1ed
SHA512c12b1a55f2596fa755defb2ab4ed00b102c7514ebfab47c6046b93df6a31fbc4b78e2b5945ba708b156eb1772ea5bf67c2fa3d9b0d997cb3419b8ad2daf23f33
-
Filesize
414KB
MD5a93943bc8508c051d6f20a08c806979c
SHA1ee6d2343e27279a5e5c715429f37dee76c910f44
SHA256cfcedb0ffa15460f8766401025af478cbaaebb0afab18640fae5d76795b345cb
SHA5125d0a7079fbcc0ae9df76ab84678508aa0c31b8820520b5b920e2796685206af4e792922f48b0daa46a458ba381cca870bf2380d504e9557bb3b8060e11c28cb4
-
Filesize
414KB
MD5a93943bc8508c051d6f20a08c806979c
SHA1ee6d2343e27279a5e5c715429f37dee76c910f44
SHA256cfcedb0ffa15460f8766401025af478cbaaebb0afab18640fae5d76795b345cb
SHA5125d0a7079fbcc0ae9df76ab84678508aa0c31b8820520b5b920e2796685206af4e792922f48b0daa46a458ba381cca870bf2380d504e9557bb3b8060e11c28cb4
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
381KB
MD52804e886f3667d74a193876f1706b85d
SHA100be9775e61de72cab316f6d174d8d344d4de2f5
SHA256ecc0aad92bab634388135c2c3072d82aad5a8b8c9ca37802eb02dccc901c61c0
SHA512a0a97c1c81022cf63d27b359e8c9988dd2b233534725556215857b73b083589e16f3001ad14194a54112ff1af0551284ce9c83c6183a856adc77345f2a286fab
-
Filesize
381KB
MD52804e886f3667d74a193876f1706b85d
SHA100be9775e61de72cab316f6d174d8d344d4de2f5
SHA256ecc0aad92bab634388135c2c3072d82aad5a8b8c9ca37802eb02dccc901c61c0
SHA512a0a97c1c81022cf63d27b359e8c9988dd2b233534725556215857b73b083589e16f3001ad14194a54112ff1af0551284ce9c83c6183a856adc77345f2a286fab