Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
162s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2023, 21:14
Static task
static1
Behavioral task
behavioral1
Sample
316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe
Resource
win10v2004-20230220-en
General
-
Target
316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe
-
Size
1.0MB
-
MD5
438a99de93dea04c083f50de928807db
-
SHA1
c6665d2fd216da99a73f45295ec9bbfffd2c1a95
-
SHA256
316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0
-
SHA512
60ef8c12be3974ccfd42e858df7ea03ffc8b6a663f89ed4263f40810143355dbe0ac4d7302a8ee7ab9ef62790622225edd36714d23afef3f7176962135783b3f
-
SSDEEP
24576:gcIu58c6Od3W36hmxGaKc1HIcf0ErjxO+TtR1N2VRDrcG3:gmZ6Od3WqFaKc1Hh8ErdOWR1N2fDrc
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/2688-1006-0x0000000009C80000-0x000000000A298000-memory.dmp redline_stealer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 195540110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 195540110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 195540110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 195540110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 195540110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 195540110.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 4208 Ir478252.exe 4608 yl554725.exe 1400 195540110.exe 2688 253376046.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 195540110.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 195540110.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce Ir478252.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Ir478252.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce yl554725.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" yl554725.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4488 1400 WerFault.exe 83 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1400 195540110.exe 1400 195540110.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1400 195540110.exe Token: SeDebugPrivilege 2688 253376046.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2136 wrote to memory of 4208 2136 316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe 81 PID 2136 wrote to memory of 4208 2136 316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe 81 PID 2136 wrote to memory of 4208 2136 316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe 81 PID 4208 wrote to memory of 4608 4208 Ir478252.exe 82 PID 4208 wrote to memory of 4608 4208 Ir478252.exe 82 PID 4208 wrote to memory of 4608 4208 Ir478252.exe 82 PID 4608 wrote to memory of 1400 4608 yl554725.exe 83 PID 4608 wrote to memory of 1400 4608 yl554725.exe 83 PID 4608 wrote to memory of 1400 4608 yl554725.exe 83 PID 4608 wrote to memory of 2688 4608 yl554725.exe 88 PID 4608 wrote to memory of 2688 4608 yl554725.exe 88 PID 4608 wrote to memory of 2688 4608 yl554725.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe"C:\Users\Admin\AppData\Local\Temp\316eac77dfb6520892a2787a72001f83f8cebdaaadc9bb39f9058e8b99a4e3d0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ir478252.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ir478252.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yl554725.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yl554725.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\195540110.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\195540110.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1400 -s 10485⤵
- Program crash
PID:4488
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\253376046.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\253376046.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1400 -ip 14001⤵PID:1972
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
722KB
MD5c0bc7316fd819601d708c897608b26c6
SHA1f721c9a7faacfd369cebb60173867de506074dac
SHA25613e2a41142ce65a43e2335ff5d6ceb921386681703dee6430bb744be57ce44a3
SHA512218df128bcc962f025e88af6198af3ab0ce990f904545688761c26e09c6be9ac4c5bc9cf0ea0f403b50fe46c986f01d0b1e4cf8f20371482e06030bc2c766b2f
-
Filesize
722KB
MD5c0bc7316fd819601d708c897608b26c6
SHA1f721c9a7faacfd369cebb60173867de506074dac
SHA25613e2a41142ce65a43e2335ff5d6ceb921386681703dee6430bb744be57ce44a3
SHA512218df128bcc962f025e88af6198af3ab0ce990f904545688761c26e09c6be9ac4c5bc9cf0ea0f403b50fe46c986f01d0b1e4cf8f20371482e06030bc2c766b2f
-
Filesize
550KB
MD5bfe2caae559bf72efbb475d3ab2eb534
SHA1d43efcdbf4c805b5fe83f05a17157ca8ef71ce0f
SHA256e8200687e65472b42df2008b06e066c5b5235a8826c7e7fde8880aa43c77b8e6
SHA51244afab2b2b51673b3cdd840a29f8f442dc0e7c1b11b8e2baad7b41e2fc0ab39901e6e4dc4556b31c0ca31dd73f0ab105262cdb88620fa5cd1c6af7242336fd59
-
Filesize
550KB
MD5bfe2caae559bf72efbb475d3ab2eb534
SHA1d43efcdbf4c805b5fe83f05a17157ca8ef71ce0f
SHA256e8200687e65472b42df2008b06e066c5b5235a8826c7e7fde8880aa43c77b8e6
SHA51244afab2b2b51673b3cdd840a29f8f442dc0e7c1b11b8e2baad7b41e2fc0ab39901e6e4dc4556b31c0ca31dd73f0ab105262cdb88620fa5cd1c6af7242336fd59
-
Filesize
278KB
MD5807f1064228e96917a18eb2b806aa900
SHA18500f8dcd597b017e367d72efae9d8b9244a7093
SHA256383ccb981b1265f4481cae6abb6c24089dd151a8cfb65152e7a7f0c1165b4c8f
SHA5126a23d9812dfb5f5e08fd6d6122956eeea45d1669f68d91d7d5cade856a8d31c2a4a53c92dd6dbd7f30d731cdd73c1ad1ff0fadef516101c7b3f7dfa389913023
-
Filesize
278KB
MD5807f1064228e96917a18eb2b806aa900
SHA18500f8dcd597b017e367d72efae9d8b9244a7093
SHA256383ccb981b1265f4481cae6abb6c24089dd151a8cfb65152e7a7f0c1165b4c8f
SHA5126a23d9812dfb5f5e08fd6d6122956eeea45d1669f68d91d7d5cade856a8d31c2a4a53c92dd6dbd7f30d731cdd73c1ad1ff0fadef516101c7b3f7dfa389913023
-
Filesize
361KB
MD547cbac6f9d0f549de8092df98638a52d
SHA18caa2a355b7992e107b5a574bcf09fbeb7771df6
SHA256fa7929ebc04e83ce66306d03a33f8b48c47bc7654dd8cf2c2ff83b54629b2dab
SHA5127c4dcccb0bf79499f1315ec7e0f736a7670fcc63a5035cf2fa18f13c9a969cd5036daa33667453d9fce385b8b1914a5f26377c69f02254800459ff63d5483ae1
-
Filesize
361KB
MD547cbac6f9d0f549de8092df98638a52d
SHA18caa2a355b7992e107b5a574bcf09fbeb7771df6
SHA256fa7929ebc04e83ce66306d03a33f8b48c47bc7654dd8cf2c2ff83b54629b2dab
SHA5127c4dcccb0bf79499f1315ec7e0f736a7670fcc63a5035cf2fa18f13c9a969cd5036daa33667453d9fce385b8b1914a5f26377c69f02254800459ff63d5483ae1