Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2023, 05:21
Static task
static1
Behavioral task
behavioral1
Sample
Rh0ES6EV.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Rh0ES6EV.exe
Resource
win10v2004-20230915-en
General
-
Target
Rh0ES6EV.exe
-
Size
1.1MB
-
MD5
eda41d4aeb1a680f6f1115003347ac6e
-
SHA1
094f662631a06c3efc7f6407c996a6aac4d3af00
-
SHA256
855c742abd80826b49dc1e2cc9240fbf5afcf29772ed4a5fae078555dd0f9b64
-
SHA512
7a92569be4de4ccdc8a60dc6bc62df0b3764ce8a6eba737afa6fc3a381375b03f47dd3387ce06d758fdcfd89f425eef42476688c844ce41025690dba242fbee2
-
SSDEEP
24576:VyorWqFGyhgEQglGijLKo/IgH51OeNgiKETcnNSJwo20FORLJ9R7:wmWqFGwg6lGijLKo/hH51OYthTWi2
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral2/files/0x00060000000231ee-27.dat family_redline behavioral2/files/0x00060000000231ee-28.dat family_redline behavioral2/memory/4024-29-0x00000000006F0000-0x000000000072E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 3740 Gq9QY7qJ.exe 1456 VL6LF0kp.exe 4556 1vj44Ir9.exe 4024 2Ru456UT.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" Rh0ES6EV.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Gq9QY7qJ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" VL6LF0kp.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4556 set thread context of 1104 4556 1vj44Ir9.exe 91 -
Program crash 2 IoCs
pid pid_target Process procid_target 1156 4556 WerFault.exe 88 3052 1104 WerFault.exe 91 -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3740 2980 Rh0ES6EV.exe 85 PID 2980 wrote to memory of 3740 2980 Rh0ES6EV.exe 85 PID 2980 wrote to memory of 3740 2980 Rh0ES6EV.exe 85 PID 3740 wrote to memory of 1456 3740 Gq9QY7qJ.exe 87 PID 3740 wrote to memory of 1456 3740 Gq9QY7qJ.exe 87 PID 3740 wrote to memory of 1456 3740 Gq9QY7qJ.exe 87 PID 1456 wrote to memory of 4556 1456 VL6LF0kp.exe 88 PID 1456 wrote to memory of 4556 1456 VL6LF0kp.exe 88 PID 1456 wrote to memory of 4556 1456 VL6LF0kp.exe 88 PID 4556 wrote to memory of 2964 4556 1vj44Ir9.exe 90 PID 4556 wrote to memory of 2964 4556 1vj44Ir9.exe 90 PID 4556 wrote to memory of 2964 4556 1vj44Ir9.exe 90 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 4556 wrote to memory of 1104 4556 1vj44Ir9.exe 91 PID 1456 wrote to memory of 4024 1456 VL6LF0kp.exe 97 PID 1456 wrote to memory of 4024 1456 VL6LF0kp.exe 97 PID 1456 wrote to memory of 4024 1456 VL6LF0kp.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\Rh0ES6EV.exe"C:\Users\Admin\AppData\Local\Temp\Rh0ES6EV.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq9QY7qJ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gq9QY7qJ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VL6LF0kp.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\VL6LF0kp.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vj44Ir9.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1vj44Ir9.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:2964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:1104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 5406⤵
- Program crash
PID:3052
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 6205⤵
- Program crash
PID:1156
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ru456UT.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ru456UT.exe4⤵
- Executes dropped EXE
PID:4024
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4556 -ip 45561⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1104 -ip 11041⤵PID:3788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
735KB
MD5ea4eaf3f6a8ddbf927e8e033b86ee229
SHA1a8f63c5a3ad87e81d2794789ab9c8932e05d076a
SHA256c9c5589f5e4159c9b3143db3ec8b92306819a91b6b130a29ab93769f168a605f
SHA512add8d321c3eab4040c8736ce6407bd0f94bc7e4e9d3eb684101330bdda13d8e3b68aaa9df3fb3e97439c2f7f018067af45135245f8c08f77148703968dbf1520
-
Filesize
735KB
MD5ea4eaf3f6a8ddbf927e8e033b86ee229
SHA1a8f63c5a3ad87e81d2794789ab9c8932e05d076a
SHA256c9c5589f5e4159c9b3143db3ec8b92306819a91b6b130a29ab93769f168a605f
SHA512add8d321c3eab4040c8736ce6407bd0f94bc7e4e9d3eb684101330bdda13d8e3b68aaa9df3fb3e97439c2f7f018067af45135245f8c08f77148703968dbf1520
-
Filesize
563KB
MD533bc60a2c387a0f31bb3d2e7b118c3a8
SHA1b6f27d4c91cb05738cec12e586f59abc06f391ac
SHA2568eb1d5e0ac77bd4427d6831806d6e31ddfbd6ceb1ad588be72d48c6d1c273b87
SHA512ab8c9815d330a4da047ff23aa802d0e9d220f2f1ffcd30d113da3a8b79bc38626f046796486948e9a55f0bb7c94e4e78fbd28a1b2c9d04ce077052d4b53437c9
-
Filesize
563KB
MD533bc60a2c387a0f31bb3d2e7b118c3a8
SHA1b6f27d4c91cb05738cec12e586f59abc06f391ac
SHA2568eb1d5e0ac77bd4427d6831806d6e31ddfbd6ceb1ad588be72d48c6d1c273b87
SHA512ab8c9815d330a4da047ff23aa802d0e9d220f2f1ffcd30d113da3a8b79bc38626f046796486948e9a55f0bb7c94e4e78fbd28a1b2c9d04ce077052d4b53437c9
-
Filesize
1.4MB
MD547c8a3a91ed2b43175bf0845388d916c
SHA1dc5606d9a552b3f5e7fef4477b2b75cd52d9ac18
SHA256252ccdf62eb74bebb006d989b4af0a3b2edb992317f9df584d60bc5f765839a2
SHA512099fb46d8f575de1277fa17dac21d839bac79f444c7cf1db6fae4cc9f5f1266f1312da773c73cb5e27d7d91de9856b7c85eb01f163f0a63c56ab3c4d64f3cbcb
-
Filesize
1.4MB
MD547c8a3a91ed2b43175bf0845388d916c
SHA1dc5606d9a552b3f5e7fef4477b2b75cd52d9ac18
SHA256252ccdf62eb74bebb006d989b4af0a3b2edb992317f9df584d60bc5f765839a2
SHA512099fb46d8f575de1277fa17dac21d839bac79f444c7cf1db6fae4cc9f5f1266f1312da773c73cb5e27d7d91de9856b7c85eb01f163f0a63c56ab3c4d64f3cbcb
-
Filesize
230KB
MD5c66671ed7345f28c77042b575f050d1e
SHA1d8531f39ba719e2a6678edd29834a04d0c9b86b6
SHA25693e56b529617683c431c3090e0504a1c369b5cc36458b46a51eb93a4308210da
SHA51214c070c39ba7a8594b72035a5a7dc68f73f381333eb80bd0cdfefc0b466e7a2cbed3ac2f962f2870f321f7838950b3d2c1d8dd76c421b0014c544e13cc3e1a99
-
Filesize
230KB
MD5c66671ed7345f28c77042b575f050d1e
SHA1d8531f39ba719e2a6678edd29834a04d0c9b86b6
SHA25693e56b529617683c431c3090e0504a1c369b5cc36458b46a51eb93a4308210da
SHA51214c070c39ba7a8594b72035a5a7dc68f73f381333eb80bd0cdfefc0b466e7a2cbed3ac2f962f2870f321f7838950b3d2c1d8dd76c421b0014c544e13cc3e1a99