Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2023, 10:43

General

  • Target

    bf4474a7b955075ef14a48e2ba631181.exe

  • Size

    538KB

  • MD5

    bf4474a7b955075ef14a48e2ba631181

  • SHA1

    ec69cb6eb45a99d4b3d0d6b276912872e56db4d9

  • SHA256

    39fe03845f04099e7100c0462b899a7846ae32620bdc41599a99a4014bc0d9af

  • SHA512

    53c3b917e24ac11351b5c47e5cd6f5019c6452cd8f2313d257edee764e857e6f17104cef96676ae13e6158f05715832307d64a4734c357ba2853a687b514e4b4

  • SSDEEP

    12288:mP+gHY5z479uqXLp1ikYaAKxuGvykXM6ffvVJ:mb45479ugYaA4uGvykcuT

Malware Config

Extracted

Family

redline

Botnet

kira

C2

77.91.68.48:19071

Attributes
  • auth_value

    1677a40fd8997eb89377e1681911e9c6

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf4474a7b955075ef14a48e2ba631181.exe
    "C:\Users\Admin\AppData\Local\Temp\bf4474a7b955075ef14a48e2ba631181.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0969918.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0969918.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2167538.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2167538.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1608
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0213278.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0213278.exe
        3⤵
        • Executes dropped EXE
        PID:1824

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log

    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0969918.exe

    Filesize

    261KB

    MD5

    ff8f41f8d820cfb682bc77c6c13808ab

    SHA1

    3167bce67ce2611855078e334e34667e0299e27d

    SHA256

    a396de8fb5b7a2395cb1f21c7da8b461f275013dbe4c64b8a79f050cfaff6b92

    SHA512

    ae7774e6f4ba1d2cd6a6b5bd445219a175f0288f2559be724fbee20be34c832764b0f10ccad86995ed6a2ca20c472be81380c106c5f5a43e4f8520e0b9015085

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y0969918.exe

    Filesize

    261KB

    MD5

    ff8f41f8d820cfb682bc77c6c13808ab

    SHA1

    3167bce67ce2611855078e334e34667e0299e27d

    SHA256

    a396de8fb5b7a2395cb1f21c7da8b461f275013dbe4c64b8a79f050cfaff6b92

    SHA512

    ae7774e6f4ba1d2cd6a6b5bd445219a175f0288f2559be724fbee20be34c832764b0f10ccad86995ed6a2ca20c472be81380c106c5f5a43e4f8520e0b9015085

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2167538.exe

    Filesize

    104KB

    MD5

    44b0d473614a92635b6e39fbb6eb8903

    SHA1

    e5f7095bface72f0d384e20bc7cb692d515b5124

    SHA256

    f8375c4e4dd963fc2fad6d66efde942bde1558c5e6d7570b91f694a97331c571

    SHA512

    014c9fab42308d02fcb6ce4756018b59e593e76eb4bf9aecb3890460675fee5ddef7ea1f1d4e30c14d5bc02dc0f89e931620f14dc379540aef103c114df93598

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\k2167538.exe

    Filesize

    104KB

    MD5

    44b0d473614a92635b6e39fbb6eb8903

    SHA1

    e5f7095bface72f0d384e20bc7cb692d515b5124

    SHA256

    f8375c4e4dd963fc2fad6d66efde942bde1558c5e6d7570b91f694a97331c571

    SHA512

    014c9fab42308d02fcb6ce4756018b59e593e76eb4bf9aecb3890460675fee5ddef7ea1f1d4e30c14d5bc02dc0f89e931620f14dc379540aef103c114df93598

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0213278.exe

    Filesize

    266KB

    MD5

    48e8f11014a2da94cfcc62412b6ef009

    SHA1

    76eb0a4b5f9f956f01d2d988aaae97c9021b4cf9

    SHA256

    212cc011131292fce872fba8067c1bfb63ee646239ef6cb8653d43ee9f94c01b

    SHA512

    f8efa4619f2773771f55918c467466d835aeca8dd1a8e0095cc569c70837b8c1eef57f5622eb39abbbb49db0f9e3b6af887b4cc989d18ec09d82a98049902db8

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l0213278.exe

    Filesize

    266KB

    MD5

    48e8f11014a2da94cfcc62412b6ef009

    SHA1

    76eb0a4b5f9f956f01d2d988aaae97c9021b4cf9

    SHA256

    212cc011131292fce872fba8067c1bfb63ee646239ef6cb8653d43ee9f94c01b

    SHA512

    f8efa4619f2773771f55918c467466d835aeca8dd1a8e0095cc569c70837b8c1eef57f5622eb39abbbb49db0f9e3b6af887b4cc989d18ec09d82a98049902db8

  • memory/1608-153-0x00000000001F0000-0x00000000001FA000-memory.dmp

    Filesize

    40KB

  • memory/1824-162-0x00000000006D0000-0x0000000000700000-memory.dmp

    Filesize

    192KB

  • memory/1824-167-0x0000000009F80000-0x000000000A598000-memory.dmp

    Filesize

    6.1MB

  • memory/1824-168-0x000000000A610000-0x000000000A71A000-memory.dmp

    Filesize

    1.0MB

  • memory/1824-169-0x000000000A750000-0x000000000A762000-memory.dmp

    Filesize

    72KB

  • memory/1824-170-0x0000000004AF0000-0x0000000004B00000-memory.dmp

    Filesize

    64KB

  • memory/1824-171-0x000000000A770000-0x000000000A7AC000-memory.dmp

    Filesize

    240KB

  • memory/1824-172-0x0000000004AF0000-0x0000000004B00000-memory.dmp

    Filesize

    64KB

  • memory/4280-133-0x00000000005C0000-0x0000000000634000-memory.dmp

    Filesize

    464KB