Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 22:40

General

  • Target

    05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe

  • Size

    827KB

  • MD5

    25ed799a31a50dd78c1e800abcff108f

  • SHA1

    f7efdf941ef9e9b792e057fb6a7f589b329eb57b

  • SHA256

    05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663

  • SHA512

    d004ba91f80b82fe17a60f9817cd2d4252ff2d76eebe573e884e1ecb535408672eaae626fa24ed179ab37a21e36af35cef25f05c3d1e9100116ad4e0cd827c98

  • SSDEEP

    24576:TyhewtCvPdmdIaYqfaFGIfLCpSQHtTltnDxm+N:mhbEdmdIaYqfaBLCpfHtpt9m+

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe
    "C:\Users\Admin\AppData\Local\Temp\05478229712fc7d9852566d2c1acdea4c0eaded7435a2ad263c2c9ad9eac3663.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1636
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXW9339.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXW9339.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRC0161.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRC0161.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2292
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it025950.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it025950.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1524
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr943041.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr943041.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2936
  • C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start wuauserv
    1⤵
    • Launches sc.exe
    PID:4972

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXW9339.exe

    Filesize

    569KB

    MD5

    b61d614ff9059e171e9b95557a2fd64b

    SHA1

    5c0cdf73c8b89c9e7d2b05f1e460e6f429f2f7d8

    SHA256

    4f348bb96fd8b0a9e29447dcfdb89339da662664cab7facf0a7f987aeb8fb1ed

    SHA512

    c12b1a55f2596fa755defb2ab4ed00b102c7514ebfab47c6046b93df6a31fbc4b78e2b5945ba708b156eb1772ea5bf67c2fa3d9b0d997cb3419b8ad2daf23f33

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziXW9339.exe

    Filesize

    569KB

    MD5

    b61d614ff9059e171e9b95557a2fd64b

    SHA1

    5c0cdf73c8b89c9e7d2b05f1e460e6f429f2f7d8

    SHA256

    4f348bb96fd8b0a9e29447dcfdb89339da662664cab7facf0a7f987aeb8fb1ed

    SHA512

    c12b1a55f2596fa755defb2ab4ed00b102c7514ebfab47c6046b93df6a31fbc4b78e2b5945ba708b156eb1772ea5bf67c2fa3d9b0d997cb3419b8ad2daf23f33

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRC0161.exe

    Filesize

    414KB

    MD5

    a93943bc8508c051d6f20a08c806979c

    SHA1

    ee6d2343e27279a5e5c715429f37dee76c910f44

    SHA256

    cfcedb0ffa15460f8766401025af478cbaaebb0afab18640fae5d76795b345cb

    SHA512

    5d0a7079fbcc0ae9df76ab84678508aa0c31b8820520b5b920e2796685206af4e792922f48b0daa46a458ba381cca870bf2380d504e9557bb3b8060e11c28cb4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziRC0161.exe

    Filesize

    414KB

    MD5

    a93943bc8508c051d6f20a08c806979c

    SHA1

    ee6d2343e27279a5e5c715429f37dee76c910f44

    SHA256

    cfcedb0ffa15460f8766401025af478cbaaebb0afab18640fae5d76795b345cb

    SHA512

    5d0a7079fbcc0ae9df76ab84678508aa0c31b8820520b5b920e2796685206af4e792922f48b0daa46a458ba381cca870bf2380d504e9557bb3b8060e11c28cb4

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it025950.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it025950.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr943041.exe

    Filesize

    381KB

    MD5

    2804e886f3667d74a193876f1706b85d

    SHA1

    00be9775e61de72cab316f6d174d8d344d4de2f5

    SHA256

    ecc0aad92bab634388135c2c3072d82aad5a8b8c9ca37802eb02dccc901c61c0

    SHA512

    a0a97c1c81022cf63d27b359e8c9988dd2b233534725556215857b73b083589e16f3001ad14194a54112ff1af0551284ce9c83c6183a856adc77345f2a286fab

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr943041.exe

    Filesize

    381KB

    MD5

    2804e886f3667d74a193876f1706b85d

    SHA1

    00be9775e61de72cab316f6d174d8d344d4de2f5

    SHA256

    ecc0aad92bab634388135c2c3072d82aad5a8b8c9ca37802eb02dccc901c61c0

    SHA512

    a0a97c1c81022cf63d27b359e8c9988dd2b233534725556215857b73b083589e16f3001ad14194a54112ff1af0551284ce9c83c6183a856adc77345f2a286fab

  • memory/1524-154-0x0000000000F30000-0x0000000000F3A000-memory.dmp

    Filesize

    40KB

  • memory/2936-161-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-160-0x0000000002CA0000-0x0000000002CE6000-memory.dmp

    Filesize

    280KB

  • memory/2936-163-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-162-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-164-0x00000000074E0000-0x0000000007A84000-memory.dmp

    Filesize

    5.6MB

  • memory/2936-165-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-166-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-168-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-170-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-172-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-176-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-174-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-178-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-182-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-184-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-180-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-186-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-188-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-192-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-200-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-204-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-202-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-206-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-214-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-218-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-220-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-216-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-226-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-224-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-228-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-222-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-212-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-210-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-208-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-198-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-196-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-194-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-190-0x0000000004A80000-0x0000000004AB5000-memory.dmp

    Filesize

    212KB

  • memory/2936-957-0x0000000009E10000-0x000000000A428000-memory.dmp

    Filesize

    6.1MB

  • memory/2936-958-0x000000000A470000-0x000000000A482000-memory.dmp

    Filesize

    72KB

  • memory/2936-959-0x000000000A490000-0x000000000A59A000-memory.dmp

    Filesize

    1.0MB

  • memory/2936-960-0x000000000A5B0000-0x000000000A5EC000-memory.dmp

    Filesize

    240KB

  • memory/2936-961-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-963-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-964-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-965-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB

  • memory/2936-966-0x00000000074D0000-0x00000000074E0000-memory.dmp

    Filesize

    64KB