Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:12

General

  • Target

    302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe

  • Size

    752KB

  • MD5

    1a19b9ee8370cd15514ed2b65076c96a

  • SHA1

    99ddc12f7c68d0192e08583b0d610b6d4e959e79

  • SHA256

    302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981

  • SHA512

    f5a47a403d12a86ddf9256dd91cea074898f929bf65ce405ae6c4ff7421af5fac811446132226088d60dc0850079769885f3f5ce3b78e6d750328af1dd153c14

  • SSDEEP

    12288:Zy908FlsPgv88KPOOD/by6TjYW/8xd3UDWb6VvqmIXk:ZyxwDpDWUD/ulUSC1IXk

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe
    "C:\Users\Admin\AppData\Local\Temp\302194ebde87a29004db7110ed3d44d2df485125376e9c49660089397933b981.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094195.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094195.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3772
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\13179686.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\13179686.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1332
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk893147.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk893147.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094195.exe

    Filesize

    598KB

    MD5

    886e7db6d7a14d54c6f3897477e93bce

    SHA1

    be925507a98efb55c249080703c1cf19160b2d78

    SHA256

    3135a788c38231d250ded397b21acc789edaf5165ce1d3cd7f1a2d5b4d1a1fb3

    SHA512

    e9fb0a32d89a39ef6458a7ba952259363434fcd35ba39cdd0d89d14daa9985c697c3edf9b0980afbf8bccc165457dc9ea9fc138d8f08b5b561e9e4da4d5409b4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un094195.exe

    Filesize

    598KB

    MD5

    886e7db6d7a14d54c6f3897477e93bce

    SHA1

    be925507a98efb55c249080703c1cf19160b2d78

    SHA256

    3135a788c38231d250ded397b21acc789edaf5165ce1d3cd7f1a2d5b4d1a1fb3

    SHA512

    e9fb0a32d89a39ef6458a7ba952259363434fcd35ba39cdd0d89d14daa9985c697c3edf9b0980afbf8bccc165457dc9ea9fc138d8f08b5b561e9e4da4d5409b4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\13179686.exe

    Filesize

    390KB

    MD5

    da4166b115f8db259cecd2611c885b9c

    SHA1

    c26941e5277cada45a97fdc77f7f6506adea2b9e

    SHA256

    1c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b

    SHA512

    8779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\13179686.exe

    Filesize

    390KB

    MD5

    da4166b115f8db259cecd2611c885b9c

    SHA1

    c26941e5277cada45a97fdc77f7f6506adea2b9e

    SHA256

    1c6497d891af5e005e7131c93a030d23cc79d5a57d8a14edb5573a6272d1da3b

    SHA512

    8779cba80921051cab681d6200516d08119a0a3142b6a36aaf14da8f382b1dbc516e7335e94c8957a8396e27601ef63fe6d0cc48768db3fb6720180c9afeccff

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk893147.exe

    Filesize

    473KB

    MD5

    c24647c0d2fda2faa8c2c0ffa43d7f59

    SHA1

    5c7265a6b6309c9a16ee6e940303921e11b5b63b

    SHA256

    8e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb

    SHA512

    8df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk893147.exe

    Filesize

    473KB

    MD5

    c24647c0d2fda2faa8c2c0ffa43d7f59

    SHA1

    5c7265a6b6309c9a16ee6e940303921e11b5b63b

    SHA256

    8e6cc0d0c0904e620895aba2f381aa48ef1dfea7cbe6bf3f8aebb51b46bcdceb

    SHA512

    8df1339bf8529e1bc04efdc8b0ccded85f5c6cf9b74cb639797a2df7da39ae163204930c2c806fca4e434c345e17442cb9fe8795e1135e44d0124a9ba6e1fd86

  • memory/640-226-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-218-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-998-0x0000000004F10000-0x0000000004F22000-memory.dmp

    Filesize

    72KB

  • memory/640-997-0x0000000007A90000-0x00000000080A8000-memory.dmp

    Filesize

    6.1MB

  • memory/640-996-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-995-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-994-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-228-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-224-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-1001-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-198-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-222-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-220-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-999-0x00000000080B0000-0x00000000081BA000-memory.dmp

    Filesize

    1.0MB

  • memory/640-216-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-212-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-213-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-214-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-210-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-208-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-209-0x0000000000970000-0x00000000009B6000-memory.dmp

    Filesize

    280KB

  • memory/640-206-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-204-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-202-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-200-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/640-1003-0x0000000008300000-0x000000000833C000-memory.dmp

    Filesize

    240KB

  • memory/640-1004-0x0000000004F50000-0x0000000004F60000-memory.dmp

    Filesize

    64KB

  • memory/640-197-0x00000000027F0000-0x0000000002825000-memory.dmp

    Filesize

    212KB

  • memory/1332-166-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-192-0x0000000000400000-0x0000000000807000-memory.dmp

    Filesize

    4.0MB

  • memory/1332-190-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/1332-189-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/1332-187-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/1332-185-0x0000000000810000-0x000000000083D000-memory.dmp

    Filesize

    180KB

  • memory/1332-184-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-182-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-180-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-178-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-176-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-174-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-172-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-170-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-168-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-164-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-162-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-160-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-158-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-157-0x0000000004D70000-0x0000000004D82000-memory.dmp

    Filesize

    72KB

  • memory/1332-156-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/1332-155-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/1332-154-0x0000000004F30000-0x00000000054D4000-memory.dmp

    Filesize

    5.6MB

  • memory/1332-153-0x0000000004F20000-0x0000000004F30000-memory.dmp

    Filesize

    64KB

  • memory/1332-151-0x0000000000400000-0x0000000000807000-memory.dmp

    Filesize

    4.0MB

  • memory/1332-149-0x0000000000810000-0x000000000083D000-memory.dmp

    Filesize

    180KB

  • memory/1332-148-0x0000000000400000-0x0000000000807000-memory.dmp

    Filesize

    4.0MB