Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
05/08/2023, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe
Resource
win10-20230703-en
General
-
Target
eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe
-
Size
560KB
-
MD5
5dcebdbc19b099fdb4da9ba3c7dc0d65
-
SHA1
edc492eb7dfc5888abb841ebe974f9c44e5f3865
-
SHA256
eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f
-
SHA512
23a1bdb832150f225674dd84543389c6a11928d684f0f051685325b0061b56e8bf0eec1bc4ab97ec6573a2f39db83baa5f4800121123b87029073060dc5edd84
-
SSDEEP
12288:GMrEy90nBfyJLlqewplYHo+BlryqLCidl8X5:Oy+0ZhHdBhy0Cy8p
Malware Config
Extracted
amadey
3.87
193.233.255.9/nasa/index.php
Extracted
redline
savin
77.91.124.156:19071
-
auth_value
a1a05b810428195ab7bb63b132ea0c8d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b019-136.dat healer behavioral1/files/0x000700000001b019-137.dat healer behavioral1/memory/860-138-0x0000000000730000-0x000000000073A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" p6045835.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" p6045835.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" p6045835.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" p6045835.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" p6045835.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3744 z0420967.exe 4748 z0472758.exe 860 p6045835.exe 2616 r8926015.exe 4160 legosa.exe 3764 s9947773.exe 2276 legosa.exe 3860 legosa.exe -
Loads dropped DLL 1 IoCs
pid Process 4108 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" p6045835.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0420967.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0472758.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4356 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 860 p6045835.exe 860 p6045835.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 860 p6045835.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 1656 wrote to memory of 3744 1656 eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe 70 PID 1656 wrote to memory of 3744 1656 eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe 70 PID 1656 wrote to memory of 3744 1656 eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe 70 PID 3744 wrote to memory of 4748 3744 z0420967.exe 71 PID 3744 wrote to memory of 4748 3744 z0420967.exe 71 PID 3744 wrote to memory of 4748 3744 z0420967.exe 71 PID 4748 wrote to memory of 860 4748 z0472758.exe 72 PID 4748 wrote to memory of 860 4748 z0472758.exe 72 PID 4748 wrote to memory of 2616 4748 z0472758.exe 73 PID 4748 wrote to memory of 2616 4748 z0472758.exe 73 PID 4748 wrote to memory of 2616 4748 z0472758.exe 73 PID 2616 wrote to memory of 4160 2616 r8926015.exe 74 PID 2616 wrote to memory of 4160 2616 r8926015.exe 74 PID 2616 wrote to memory of 4160 2616 r8926015.exe 74 PID 3744 wrote to memory of 3764 3744 z0420967.exe 75 PID 3744 wrote to memory of 3764 3744 z0420967.exe 75 PID 3744 wrote to memory of 3764 3744 z0420967.exe 75 PID 4160 wrote to memory of 4356 4160 legosa.exe 76 PID 4160 wrote to memory of 4356 4160 legosa.exe 76 PID 4160 wrote to memory of 4356 4160 legosa.exe 76 PID 4160 wrote to memory of 4848 4160 legosa.exe 77 PID 4160 wrote to memory of 4848 4160 legosa.exe 77 PID 4160 wrote to memory of 4848 4160 legosa.exe 77 PID 4848 wrote to memory of 1536 4848 cmd.exe 80 PID 4848 wrote to memory of 1536 4848 cmd.exe 80 PID 4848 wrote to memory of 1536 4848 cmd.exe 80 PID 4848 wrote to memory of 4544 4848 cmd.exe 81 PID 4848 wrote to memory of 4544 4848 cmd.exe 81 PID 4848 wrote to memory of 4544 4848 cmd.exe 81 PID 4848 wrote to memory of 1036 4848 cmd.exe 82 PID 4848 wrote to memory of 1036 4848 cmd.exe 82 PID 4848 wrote to memory of 1036 4848 cmd.exe 82 PID 4848 wrote to memory of 4620 4848 cmd.exe 83 PID 4848 wrote to memory of 4620 4848 cmd.exe 83 PID 4848 wrote to memory of 4620 4848 cmd.exe 83 PID 4848 wrote to memory of 3360 4848 cmd.exe 84 PID 4848 wrote to memory of 3360 4848 cmd.exe 84 PID 4848 wrote to memory of 3360 4848 cmd.exe 84 PID 4848 wrote to memory of 1332 4848 cmd.exe 85 PID 4848 wrote to memory of 1332 4848 cmd.exe 85 PID 4848 wrote to memory of 1332 4848 cmd.exe 85 PID 4160 wrote to memory of 4108 4160 legosa.exe 87 PID 4160 wrote to memory of 4108 4160 legosa.exe 87 PID 4160 wrote to memory of 4108 4160 legosa.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe"C:\Users\Admin\AppData\Local\Temp\eaca6ec0812ac2bc7bc99d952abe5e75f4d5d460e95e40f15adb57f38339451f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0420967.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0420967.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0472758.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0472758.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6045835.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p6045835.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8926015.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r8926015.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legosa.exe /TR "C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe" /F6⤵
- Creates scheduled task(s)
PID:4356
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legosa.exe" /P "Admin:N"&&CACLS "legosa.exe" /P "Admin:R" /E&&echo Y|CACLS "..\ebb444342c" /P "Admin:N"&&CACLS "..\ebb444342c" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1536
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:N"7⤵PID:4544
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "legosa.exe" /P "Admin:R" /E7⤵PID:1036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4620
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:N"7⤵PID:3360
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\ebb444342c" /P "Admin:R" /E7⤵PID:1332
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4108
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s9947773.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\s9947773.exe3⤵
- Executes dropped EXE
PID:3764
-
-
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:2276
-
C:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exeC:\Users\Admin\AppData\Local\Temp\ebb444342c\legosa.exe1⤵
- Executes dropped EXE
PID:3860
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
433KB
MD503979f5b8f723ee0820879f5117e04a9
SHA1ff2e133a2d21002cc7ef8b4c89e0f1d5db0c2eaa
SHA2568e6601166420d7952bf7423d1ae6a9c1f88e63f0647a17a14b83d33f2bdf875a
SHA512baba110374d856cff8eb66f9af9b2defa26b73db34fb1f2832e06f3ee88f9223ae02e5d5382ba39ce4fa7733a16765986f495d7d20f29c535418d466804906f8
-
Filesize
433KB
MD503979f5b8f723ee0820879f5117e04a9
SHA1ff2e133a2d21002cc7ef8b4c89e0f1d5db0c2eaa
SHA2568e6601166420d7952bf7423d1ae6a9c1f88e63f0647a17a14b83d33f2bdf875a
SHA512baba110374d856cff8eb66f9af9b2defa26b73db34fb1f2832e06f3ee88f9223ae02e5d5382ba39ce4fa7733a16765986f495d7d20f29c535418d466804906f8
-
Filesize
174KB
MD5a9490f8283a11b6eb6a06fc06cee64d6
SHA1984b1d08e9e57110f9db0e00fbd8aa0465c40d3a
SHA2568c50852768b76503fac5cefc4a56ca11576e4f5d0a6a9ef3badfcbc97e29f74e
SHA512cc4cc8b10652985dee8011e38a8bf1e7ebc0c610f501a8574fb003a9659b28449d090c41114f53540f0d24835cc26644ed44e5dab5ae008206d9ec864e7948fc
-
Filesize
174KB
MD5a9490f8283a11b6eb6a06fc06cee64d6
SHA1984b1d08e9e57110f9db0e00fbd8aa0465c40d3a
SHA2568c50852768b76503fac5cefc4a56ca11576e4f5d0a6a9ef3badfcbc97e29f74e
SHA512cc4cc8b10652985dee8011e38a8bf1e7ebc0c610f501a8574fb003a9659b28449d090c41114f53540f0d24835cc26644ed44e5dab5ae008206d9ec864e7948fc
-
Filesize
277KB
MD58903171ca9d6546b74ba5e06b126bbc2
SHA1ae864aae89db8d42c71e9d771a4739689c501f7d
SHA2562c49f057d09fa72d8d3732d936fe4350749c01502be8d306995afb165c007085
SHA5125a0ac38b8b6c9ad8d1512b139015553ee21a1b60aa8cd4f5e642c6403430a91ce2d1b54672591a15d3bd7614048181b8b927df96acfd1a7fcdf93c31fda3695d
-
Filesize
277KB
MD58903171ca9d6546b74ba5e06b126bbc2
SHA1ae864aae89db8d42c71e9d771a4739689c501f7d
SHA2562c49f057d09fa72d8d3732d936fe4350749c01502be8d306995afb165c007085
SHA5125a0ac38b8b6c9ad8d1512b139015553ee21a1b60aa8cd4f5e642c6403430a91ce2d1b54672591a15d3bd7614048181b8b927df96acfd1a7fcdf93c31fda3695d
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
313KB
MD52c1528a6992ce0ac3a41d0da5cf846ba
SHA1c315a74e85861b7abd2b9f213982f536a018a63d
SHA256b269720acebdba99f8294306dfe575089c8e915af45556e49f82a9d7f1460742
SHA512f6675f6260e335f7e8001808070e446cefa84460ef3b9d6dd6b9dbee5db6276af510944823a9de3ea23f9c879340772625b10e0fcfd6b6d9ba1c288dc0fa1341
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
89KB
MD543762ddccb9db44ea9914e448ba3e43e
SHA187e5766061740cf4a570133af6108399a11dbd1b
SHA256459b0a16d82e7150ad3fa2cbc740a2b6a33606894669f5febe5d15c20b4cc0ef
SHA512ea0ef8d32c3776baf2e1bd2456797d64ff8214810af41b3a59ee649ecd67e1fffeebe2f4b21c4e2671909a2d1ab8071d8eac261c4233662a686a575c1145d651