Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    248s
  • max time network
    265s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 20:14

General

  • Target

    03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7.exe

  • Size

    653KB

  • MD5

    2f92b60f95c45ba90212f753ed335497

  • SHA1

    3d7be526c02f302020507522c684dee91a058c65

  • SHA256

    03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7

  • SHA512

    017e9dac743909dabde6ff834ecfa2dc45b6ada3d2eba7e35512c2fc02ace3d0b6528d5de70866924ef3be4779eb7e7bd94aa4bdf57c3081f137c6f2f9576c62

  • SSDEEP

    12288:0y90uZ+wYJAQ+RxMK3LZrZMDgI6RDJm2sbuHepve2PGzU3vNBGZGCRib:0yzZ+wYsyKbZ9nHJJlsqep22VvNyRib

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7.exe
    "C:\Users\Admin\AppData\Local\Temp\03b7f1ec1a594873467211338a87aca1299d543be8e25ae29cea42c37e93e9f7.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:116
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3752
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4600
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe
      2⤵
      • Executes dropped EXE
      PID:3016

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr803514.exe

    Filesize

    136KB

    MD5

    e1c805d3cefe221689da30b8a2d944f2

    SHA1

    a9a94fd89ed22c2a127c81f6e57f822eae1d9f26

    SHA256

    32023b065401cf468d0088e334ad60bf12afc3d552030a6a3500e74500de735a

    SHA512

    7801b1432717a8105f7f255d7387eaffa264eddf74e6b782776d548f9dbb82b5223c7412df3cbc8e91cc63988e2e04a8160280f697e93d0fa5d056dc183252e7

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe

    Filesize

    499KB

    MD5

    f14e292dee76533c24e8e81385f93b98

    SHA1

    b6239a7452dd5a4b837aa3ba3ff7666adec12964

    SHA256

    4799bf5cc66cbb158f7b14e7bfa24519bd27f8721c240a0ce373893e59e46398

    SHA512

    3b0e90acbb2c387e6ec684cbd5690dbcffe1fb4bf886047c8d64a2519d9e79de89a3111001c8e1cabf7d2ef1b2556d3b3ede9a931a5e7636bca9ba869e7d7679

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st096493.exe

    Filesize

    499KB

    MD5

    f14e292dee76533c24e8e81385f93b98

    SHA1

    b6239a7452dd5a4b837aa3ba3ff7666adec12964

    SHA256

    4799bf5cc66cbb158f7b14e7bfa24519bd27f8721c240a0ce373893e59e46398

    SHA512

    3b0e90acbb2c387e6ec684cbd5690dbcffe1fb4bf886047c8d64a2519d9e79de89a3111001c8e1cabf7d2ef1b2556d3b3ede9a931a5e7636bca9ba869e7d7679

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\78041499.exe

    Filesize

    175KB

    MD5

    3d10b67208452d7a91d7bd7066067676

    SHA1

    e6c3ab7b6da65c8cc7dd95351f118caf3a50248d

    SHA256

    5c8ae96739bd9454a59e92b5eb6965647030e87453f7c417dbd7d53ebd837302

    SHA512

    b86d5ff4f55c90922a890401ae4301da7e71eb5e546a82536073cc58780ce55585214cff39ec9b52f70704580ad36c1fa95ebee1515dd2e7ea313cb670f2b4df

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp692677.exe

    Filesize

    342KB

    MD5

    3550637119b32b565671c90d5a19ba2c

    SHA1

    5dc5c8175ebce0f55e30ac474744de299818f3d2

    SHA256

    4c71e0c44580aa82a5a7b3dc9382556ff0760a4c8df6ae6dac9ee8de7774887a

    SHA512

    ac992575f2b94518719ae26ff9dea97228f66315d716896b8afce73908705dc15a48120febb298695c83fd1be840acc32908463613fd88fae540fbcfc096055c

  • memory/116-162-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-174-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-156-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-158-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-160-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-152-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-164-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-166-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-168-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-170-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-172-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-154-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-176-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-178-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-179-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/116-180-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/116-181-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/116-151-0x00000000023E0000-0x00000000023F3000-memory.dmp

    Filesize

    76KB

  • memory/116-150-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/116-149-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/116-148-0x0000000004970000-0x0000000004980000-memory.dmp

    Filesize

    64KB

  • memory/116-147-0x0000000004980000-0x0000000004F24000-memory.dmp

    Filesize

    5.6MB

  • memory/3016-196-0x0000000000C10000-0x0000000000C38000-memory.dmp

    Filesize

    160KB

  • memory/3016-201-0x0000000007940000-0x0000000007952000-memory.dmp

    Filesize

    72KB

  • memory/3016-1006-0x00000000054A0000-0x00000000054B0000-memory.dmp

    Filesize

    64KB

  • memory/3016-1003-0x00000000054A0000-0x00000000054B0000-memory.dmp

    Filesize

    64KB

  • memory/3016-1001-0x0000000005460000-0x000000000549C000-memory.dmp

    Filesize

    240KB

  • memory/3016-199-0x0000000007F00000-0x0000000008518000-memory.dmp

    Filesize

    6.1MB

  • memory/3016-995-0x0000000007A70000-0x0000000007B7A000-memory.dmp

    Filesize

    1.0MB

  • memory/3752-187-0x00000000005C0000-0x0000000000607000-memory.dmp

    Filesize

    284KB

  • memory/4600-198-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-230-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-190-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/4600-206-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-208-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-210-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-212-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-214-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-216-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-217-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/4600-220-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-219-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-224-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-223-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-221-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-204-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-228-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-226-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-232-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-234-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-202-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-997-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-998-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-999-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-197-0x0000000002430000-0x0000000002465000-memory.dmp

    Filesize

    212KB

  • memory/4600-1002-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-191-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB

  • memory/4600-1005-0x0000000004B40000-0x0000000004B50000-memory.dmp

    Filesize

    64KB

  • memory/4600-188-0x0000000000400000-0x0000000000449000-memory.dmp

    Filesize

    292KB