Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
189s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06/05/2023, 20:52
Static task
static1
Behavioral task
behavioral1
Sample
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe
Resource
win10v2004-20230220-en
General
-
Target
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe
-
Size
685KB
-
MD5
a535488d1208eb430fef9fa3ccf1f6e8
-
SHA1
ee7607dd58e4655c4a33eb1b1cf3eb31fd7a2fdf
-
SHA256
1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f
-
SHA512
b6161d268bd6038dd2791b8c573dd2620e35ba42e6f0969e4e9c3266d648a3f1cfd73907691e4d1cc2c9798779bfe705ea998505573d4531d2d0caf315b6cbe0
-
SSDEEP
12288:py902dT4IOxGBG+RVVlMFWyCSKVx5mKZbkNDWYmXZ5Sy8r/3A6Hyd7h:pybdEIOQdMoSy3mLWrXPSbwmWh
Malware Config
Signatures
-
Detects Redline Stealer samples 1 IoCs
This rule detects the presence of Redline Stealer samples based on their unique strings.
resource yara_rule behavioral2/memory/2716-990-0x0000000009C70000-0x000000000A288000-memory.dmp redline_stealer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 42094843.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 3 IoCs
pid Process 232 un880540.exe 4980 42094843.exe 2716 rk731241.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 42094843.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 42094843.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un880540.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un880540.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 548 4980 WerFault.exe 85 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4980 42094843.exe 4980 42094843.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4980 42094843.exe Token: SeDebugPrivilege 2716 rk731241.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4712 wrote to memory of 232 4712 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 84 PID 4712 wrote to memory of 232 4712 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 84 PID 4712 wrote to memory of 232 4712 1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe 84 PID 232 wrote to memory of 4980 232 un880540.exe 85 PID 232 wrote to memory of 4980 232 un880540.exe 85 PID 232 wrote to memory of 4980 232 un880540.exe 85 PID 232 wrote to memory of 2716 232 un880540.exe 89 PID 232 wrote to memory of 2716 232 un880540.exe 89 PID 232 wrote to memory of 2716 232 un880540.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe"C:\Users\Admin\AppData\Local\Temp\1f271567be6e1d3ef6edb068a3afb6f3de43076b906d28cb9466e55e400ab54f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un880540.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un880540.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42094843.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\42094843.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4980 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 10204⤵
- Program crash
PID:548
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk731241.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk731241.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4980 -ip 49801⤵PID:4808
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
531KB
MD5dd47cee50a17e1022ee2398f113a6c22
SHA1a4a5824780f2477257dc68b0dc5d43b1c148ca32
SHA256b0632fed1accbb14070c0191fbbbcc36b0f981f61e403d5c38e9a6f8357c9dd9
SHA51280be477a45cea718c99f16105a6d191bde25d56d03b50ba8887c7402b76298710fd696f46df6d0b66ca3c47ca991e74841b91712b8418ec492c5560275bef219
-
Filesize
531KB
MD5dd47cee50a17e1022ee2398f113a6c22
SHA1a4a5824780f2477257dc68b0dc5d43b1c148ca32
SHA256b0632fed1accbb14070c0191fbbbcc36b0f981f61e403d5c38e9a6f8357c9dd9
SHA51280be477a45cea718c99f16105a6d191bde25d56d03b50ba8887c7402b76298710fd696f46df6d0b66ca3c47ca991e74841b91712b8418ec492c5560275bef219
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
249KB
MD568cf4b598154c0f8202208bfc69c983a
SHA17eb1b010ee6aabbc3f5c367e4844d29a9dad4c14
SHA256f9f2d7be6fdff3a2989ec9a86e5ea0cb1d23afb298a4b14cd56d5ec94685f347
SHA512b53da746cd4fecb856116c37869274d6c43993e34f218ec28b45b094f87017717925bc4f09bbadbf05d0c40a2918798a82b35ea255edfd71b671cfc579f83c30
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239
-
Filesize
332KB
MD55b43d5c5f3670cbb7b9065cde42aa509
SHA131e574bfb5439d0f8f39407dda555b2c7e5c21e6
SHA25601b97fe861bb19bcf3680a56a04f3b382d87d4d032bafc5f5d4e1e1b26e51679
SHA512154a1880da5e3b667e30243ac0a4c73b35cbac526ab650140340119089194c187d7dd9133035c988599438db742c61ebc80cac4173d303fd5ec4b57ec14e4239