Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
15/08/2023, 13:42
Static task
static1
Behavioral task
behavioral1
Sample
435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe
Resource
win10-20230703-en
General
-
Target
435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe
-
Size
564KB
-
MD5
2f6fcc451c488a63ab446859ce4247a4
-
SHA1
b5fbd77c618b5baed679ff40d9627ec113197fcb
-
SHA256
435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786
-
SHA512
af643bddf3760a6282f7f529c77f5fa7df246b0aa851096383152a9db21aaf7f523a8e2ce127fbdec0295c500c62c3d2fb90592379d943df582b61c715481152
-
SSDEEP
12288:DMrby90llyTZbGWUmnXTTDxHk0+g04YJxfnO:AybZyDmnjTDT+J4Yq
Malware Config
Extracted
redline
meson
77.91.124.54:19071
-
auth_value
47ca57ebe5c142c9ad4650f71bf57877
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b018-139.dat healer behavioral1/files/0x000700000001b018-140.dat healer behavioral1/memory/632-141-0x0000000000550000-0x000000000055A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" r6118346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" r6118346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" r6118346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" r6118346.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" r6118346.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 2344 z9750249.exe 4460 z7396468.exe 632 r6118346.exe 3544 s5834327.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" r6118346.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9750249.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7396468.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 632 r6118346.exe 632 r6118346.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 632 r6118346.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4156 wrote to memory of 2344 4156 435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe 70 PID 4156 wrote to memory of 2344 4156 435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe 70 PID 4156 wrote to memory of 2344 4156 435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe 70 PID 2344 wrote to memory of 4460 2344 z9750249.exe 71 PID 2344 wrote to memory of 4460 2344 z9750249.exe 71 PID 2344 wrote to memory of 4460 2344 z9750249.exe 71 PID 4460 wrote to memory of 632 4460 z7396468.exe 72 PID 4460 wrote to memory of 632 4460 z7396468.exe 72 PID 4460 wrote to memory of 3544 4460 z7396468.exe 73 PID 4460 wrote to memory of 3544 4460 z7396468.exe 73 PID 4460 wrote to memory of 3544 4460 z7396468.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe"C:\Users\Admin\AppData\Local\Temp\435235eca2f2e55f7fdfaaa27443508336cef2c056907ef4555dccadd51e7786.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9750249.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9750249.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7396468.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7396468.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6118346.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\r6118346.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:632
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s5834327.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\s5834327.exe4⤵
- Executes dropped EXE
PID:3544
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
431KB
MD5b8ac7822486e96dac415c898552ac351
SHA12a81fb3e20389836c7b8ef2e76f1838c611dd7d5
SHA256590a52b3c2464e4426a1432d6ef445723cc2775c8093053c4197dfe2fbb2197d
SHA51257c014bb29f407ef1392bf9e521602c7437b9160c220e2a7ce9ffe228605d471db20f6b36416572fce975fbf0ec54ddea7cabba4f82c7d07b4dc6123ebd04539
-
Filesize
431KB
MD5b8ac7822486e96dac415c898552ac351
SHA12a81fb3e20389836c7b8ef2e76f1838c611dd7d5
SHA256590a52b3c2464e4426a1432d6ef445723cc2775c8093053c4197dfe2fbb2197d
SHA51257c014bb29f407ef1392bf9e521602c7437b9160c220e2a7ce9ffe228605d471db20f6b36416572fce975fbf0ec54ddea7cabba4f82c7d07b4dc6123ebd04539
-
Filesize
206KB
MD55406562bcca799e538db1f66aa33a397
SHA1e9e2f820a2d80d1d69ea243dea01842732c5d025
SHA2560a06d924c2ee8babbd53aa81a05a26cc2715b158392f80ea1355794843dd7bf7
SHA51256654366a4b1def68d0c30587bcc0c4345b2e566dca95e5b634ade8a628bb17938b882df372aa31461efa00dffc5bd89db081df035224462abeae6e7f0686024
-
Filesize
206KB
MD55406562bcca799e538db1f66aa33a397
SHA1e9e2f820a2d80d1d69ea243dea01842732c5d025
SHA2560a06d924c2ee8babbd53aa81a05a26cc2715b158392f80ea1355794843dd7bf7
SHA51256654366a4b1def68d0c30587bcc0c4345b2e566dca95e5b634ade8a628bb17938b882df372aa31461efa00dffc5bd89db081df035224462abeae6e7f0686024
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
174KB
MD571755da2ad6d04e34af57974394904bd
SHA112eb990abdd6a067fede8dbfdf53b6076415d6ba
SHA256fa4c0400f2100f27843122d6626e53b3fd8cf4af1ba43ab99f637716bfedf691
SHA512a8d9dc9cd3a931a3124345f37bf77e79b01847f91a788d629bdec3e0553eb136fc16d3a888fbbeeb2d3a048ab227314da926a7fa02205156101bd34f32c83106
-
Filesize
174KB
MD571755da2ad6d04e34af57974394904bd
SHA112eb990abdd6a067fede8dbfdf53b6076415d6ba
SHA256fa4c0400f2100f27843122d6626e53b3fd8cf4af1ba43ab99f637716bfedf691
SHA512a8d9dc9cd3a931a3124345f37bf77e79b01847f91a788d629bdec3e0553eb136fc16d3a888fbbeeb2d3a048ab227314da926a7fa02205156101bd34f32c83106