Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2023, 21:07

General

  • Target

    2b52c099160f823946bb195e662c36a9f0938622d91be40d6d08a021c409b549.exe

  • Size

    674KB

  • MD5

    7f5d213cb5da614bae79dc55c5f7388d

  • SHA1

    1ef457921f68ce987eb83a020e594153f4a92873

  • SHA256

    2b52c099160f823946bb195e662c36a9f0938622d91be40d6d08a021c409b549

  • SHA512

    07caedbc460602331d898619700989ae3219d798196862045bb7ad83c9dd3955bdf31f8d2779ae8691cc320455e95bf4150085cd7de5af4e4f9cef4e39eace28

  • SSDEEP

    12288:Ay90G7cQB3i5iTkvy/YFhGxwPsk0gULPL4Kx8cr86oa7lw23qVh8ok:AyB753i5t6/YFIxwPsh/7L4KJxwwMxk

Malware Config

Signatures

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b52c099160f823946bb195e662c36a9f0938622d91be40d6d08a021c409b549.exe
    "C:\Users\Admin\AppData\Local\Temp\2b52c099160f823946bb195e662c36a9f0938622d91be40d6d08a021c409b549.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st565474.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st565474.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53910562.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53910562.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4756
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp314966.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp314966.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3964

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st565474.exe

    Filesize

    519KB

    MD5

    1f9cdfd808c848a077ea9a3a0ec0c354

    SHA1

    88dff21276e5b1e75fa9c72a60e7536b6d60fe74

    SHA256

    83294c15538ef319add50b5ee4a93ea8f096813a395723e181d4fbb9b5828716

    SHA512

    4b6799c4d5bd72d87cce08b4512d77175eb83ec910ba2af8f93fe84dc268da8a8ea9898281fdbeb4f3c7d6aaab417795e58de95473d8967f7443e8337484d00c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\st565474.exe

    Filesize

    519KB

    MD5

    1f9cdfd808c848a077ea9a3a0ec0c354

    SHA1

    88dff21276e5b1e75fa9c72a60e7536b6d60fe74

    SHA256

    83294c15538ef319add50b5ee4a93ea8f096813a395723e181d4fbb9b5828716

    SHA512

    4b6799c4d5bd72d87cce08b4512d77175eb83ec910ba2af8f93fe84dc268da8a8ea9898281fdbeb4f3c7d6aaab417795e58de95473d8967f7443e8337484d00c

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53910562.exe

    Filesize

    175KB

    MD5

    a165b5f6b0a4bdf808b71de57bf9347d

    SHA1

    39a7b301e819e386c162a47e046fa384bb5ab437

    SHA256

    68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

    SHA512

    3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\53910562.exe

    Filesize

    175KB

    MD5

    a165b5f6b0a4bdf808b71de57bf9347d

    SHA1

    39a7b301e819e386c162a47e046fa384bb5ab437

    SHA256

    68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

    SHA512

    3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp314966.exe

    Filesize

    415KB

    MD5

    3a35e4da6e1b8b0e5136f9449910bcbb

    SHA1

    33c5ac6ee651d1a00c37967c3515bae223a69c67

    SHA256

    9d0229f8a4fb8abee2782cb9696466ad3087fd00be8d343b56c6a24107d146c0

    SHA512

    44db765ad1882a9151ae02080069c06c8fe8ca424e04d3956f882b153f506998a3aa5d73f1e1318e33bf6175fee4e01388b4406fb1da099a0d002a6832a6432b

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp314966.exe

    Filesize

    415KB

    MD5

    3a35e4da6e1b8b0e5136f9449910bcbb

    SHA1

    33c5ac6ee651d1a00c37967c3515bae223a69c67

    SHA256

    9d0229f8a4fb8abee2782cb9696466ad3087fd00be8d343b56c6a24107d146c0

    SHA512

    44db765ad1882a9151ae02080069c06c8fe8ca424e04d3956f882b153f506998a3aa5d73f1e1318e33bf6175fee4e01388b4406fb1da099a0d002a6832a6432b

  • memory/3964-218-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-233-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-988-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-987-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-986-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-985-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-983-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-982-0x0000000007D20000-0x0000000007D5C000-memory.dmp

    Filesize

    240KB

  • memory/3964-981-0x0000000007BF0000-0x0000000007CFA000-memory.dmp

    Filesize

    1.0MB

  • memory/3964-196-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-979-0x0000000007510000-0x0000000007B28000-memory.dmp

    Filesize

    6.1MB

  • memory/3964-235-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-237-0x0000000004A90000-0x0000000004AA0000-memory.dmp

    Filesize

    64KB

  • memory/3964-231-0x0000000000730000-0x0000000000776000-memory.dmp

    Filesize

    280KB

  • memory/3964-194-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-216-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-214-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-212-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-184-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-183-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-186-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-188-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-190-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-192-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-210-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-980-0x0000000007BD0000-0x0000000007BE2000-memory.dmp

    Filesize

    72KB

  • memory/3964-198-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-200-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-202-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-204-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-206-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/3964-208-0x0000000004A40000-0x0000000004A75000-memory.dmp

    Filesize

    212KB

  • memory/4756-168-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-166-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-170-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-177-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

    Filesize

    64KB

  • memory/4756-147-0x0000000004BA0000-0x0000000004BB0000-memory.dmp

    Filesize

    64KB

  • memory/4756-176-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-174-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-150-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-148-0x0000000004BB0000-0x0000000005154000-memory.dmp

    Filesize

    5.6MB

  • memory/4756-172-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-149-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-164-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-162-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-160-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-158-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-156-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-154-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB

  • memory/4756-152-0x0000000004AA0000-0x0000000004AB3000-memory.dmp

    Filesize

    76KB