Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
17/08/2023, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe
Resource
win10-20230703-en
General
-
Target
b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe
-
Size
729KB
-
MD5
2c0b9718236ecc3a4d304f074cac4b13
-
SHA1
1de49cce930bd96b3463c7adc938668c7dfcd544
-
SHA256
b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf
-
SHA512
cb0dd5304a5d6f563c1a8cfe3fd72b19fd8c0eab16ed58df02a94a7e6a6d3590309b1ccb7c147dddadedd92fd7973e069bbd99e83fa9ce337a609c0684ff67c7
-
SSDEEP
12288:fMr4y90mWVg9Dwuw662u2wVZK6q7CME/cFsPWvI06N7yWU35QCh16xUetfwCgfDY:Xy9kuwWuFZKv7CME0sPX06N7yW+CCf6F
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
maga
77.91.124.54:19071
-
auth_value
9dd7a0be219be9b6228dc9b4e112b812
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001afd5-146.dat healer behavioral1/files/0x000700000001afd5-147.dat healer behavioral1/memory/3112-148-0x00000000005B0000-0x00000000005BA000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l4259012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l4259012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l4259012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l4259012.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l4259012.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 5080 y9322027.exe 4400 y9233333.exe 3892 y1451027.exe 3112 l4259012.exe 2112 m7286733.exe 3576 saves.exe 4716 n6606248.exe 2136 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 3256 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" l4259012.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y9322027.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y9233333.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y1451027.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4936 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3112 l4259012.exe 3112 l4259012.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3112 l4259012.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2040 wrote to memory of 5080 2040 b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe 69 PID 2040 wrote to memory of 5080 2040 b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe 69 PID 2040 wrote to memory of 5080 2040 b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe 69 PID 5080 wrote to memory of 4400 5080 y9322027.exe 70 PID 5080 wrote to memory of 4400 5080 y9322027.exe 70 PID 5080 wrote to memory of 4400 5080 y9322027.exe 70 PID 4400 wrote to memory of 3892 4400 y9233333.exe 71 PID 4400 wrote to memory of 3892 4400 y9233333.exe 71 PID 4400 wrote to memory of 3892 4400 y9233333.exe 71 PID 3892 wrote to memory of 3112 3892 y1451027.exe 72 PID 3892 wrote to memory of 3112 3892 y1451027.exe 72 PID 3892 wrote to memory of 2112 3892 y1451027.exe 73 PID 3892 wrote to memory of 2112 3892 y1451027.exe 73 PID 3892 wrote to memory of 2112 3892 y1451027.exe 73 PID 2112 wrote to memory of 3576 2112 m7286733.exe 74 PID 2112 wrote to memory of 3576 2112 m7286733.exe 74 PID 2112 wrote to memory of 3576 2112 m7286733.exe 74 PID 4400 wrote to memory of 4716 4400 y9233333.exe 75 PID 4400 wrote to memory of 4716 4400 y9233333.exe 75 PID 4400 wrote to memory of 4716 4400 y9233333.exe 75 PID 3576 wrote to memory of 4936 3576 saves.exe 76 PID 3576 wrote to memory of 4936 3576 saves.exe 76 PID 3576 wrote to memory of 4936 3576 saves.exe 76 PID 3576 wrote to memory of 2164 3576 saves.exe 77 PID 3576 wrote to memory of 2164 3576 saves.exe 77 PID 3576 wrote to memory of 2164 3576 saves.exe 77 PID 2164 wrote to memory of 3720 2164 cmd.exe 80 PID 2164 wrote to memory of 3720 2164 cmd.exe 80 PID 2164 wrote to memory of 3720 2164 cmd.exe 80 PID 2164 wrote to memory of 2200 2164 cmd.exe 81 PID 2164 wrote to memory of 2200 2164 cmd.exe 81 PID 2164 wrote to memory of 2200 2164 cmd.exe 81 PID 2164 wrote to memory of 4424 2164 cmd.exe 82 PID 2164 wrote to memory of 4424 2164 cmd.exe 82 PID 2164 wrote to memory of 4424 2164 cmd.exe 82 PID 2164 wrote to memory of 4792 2164 cmd.exe 83 PID 2164 wrote to memory of 4792 2164 cmd.exe 83 PID 2164 wrote to memory of 4792 2164 cmd.exe 83 PID 2164 wrote to memory of 3452 2164 cmd.exe 84 PID 2164 wrote to memory of 3452 2164 cmd.exe 84 PID 2164 wrote to memory of 3452 2164 cmd.exe 84 PID 2164 wrote to memory of 4448 2164 cmd.exe 85 PID 2164 wrote to memory of 4448 2164 cmd.exe 85 PID 2164 wrote to memory of 4448 2164 cmd.exe 85 PID 3576 wrote to memory of 3256 3576 saves.exe 87 PID 3576 wrote to memory of 3256 3576 saves.exe 87 PID 3576 wrote to memory of 3256 3576 saves.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe"C:\Users\Admin\AppData\Local\Temp\b5da8cb8a72c33f8224184d8ca045d3cc4e21a1adcd39e84e7004166d91c71cf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9322027.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9322027.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9233333.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y9233333.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1451027.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y1451027.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4259012.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l4259012.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3112
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m7286733.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m7286733.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:4936
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3720
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2200
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:4424
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4792
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3452
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:4448
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:3256
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6606248.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6606248.exe4⤵
- Executes dropped EXE
PID:4716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2136
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
599KB
MD5666ce91266cb06dceb731b8c9345139b
SHA1c71bc038227a653d1390349a9fe7c39d29191693
SHA256d967ceea8ccf79a2a8d61235ebd8b6a73f843bb14da9281f473444f79d95860c
SHA5121009893b7bfd34b9fdc4bc3adaba1a4e549c18588ed60fe3ad9fdcd9fa24a69ca8f31dff65cb24565e05400cae54ea8c241093c2685d907a4430aa5d4e7b4ddf
-
Filesize
599KB
MD5666ce91266cb06dceb731b8c9345139b
SHA1c71bc038227a653d1390349a9fe7c39d29191693
SHA256d967ceea8ccf79a2a8d61235ebd8b6a73f843bb14da9281f473444f79d95860c
SHA5121009893b7bfd34b9fdc4bc3adaba1a4e549c18588ed60fe3ad9fdcd9fa24a69ca8f31dff65cb24565e05400cae54ea8c241093c2685d907a4430aa5d4e7b4ddf
-
Filesize
433KB
MD5cc3bb36fca5a07f7fa3b5b03c9009a5d
SHA142b8c55d0637a4031b7f7255f73b710f43575c59
SHA25681b3dd60814607a8292992cefdcc9070ee75118cb1435c28af14efc3ce610f23
SHA5128bec7c3adca0f974ca3d63da77cf5dc2977ba1b2a279390acd99d0e883877d84bcd3fa68e6a289e47c58c926e50cbaa4fc90683f3f4ae5a1e07a3d61002db3d6
-
Filesize
433KB
MD5cc3bb36fca5a07f7fa3b5b03c9009a5d
SHA142b8c55d0637a4031b7f7255f73b710f43575c59
SHA25681b3dd60814607a8292992cefdcc9070ee75118cb1435c28af14efc3ce610f23
SHA5128bec7c3adca0f974ca3d63da77cf5dc2977ba1b2a279390acd99d0e883877d84bcd3fa68e6a289e47c58c926e50cbaa4fc90683f3f4ae5a1e07a3d61002db3d6
-
Filesize
174KB
MD52da2f9ae775abd09007e79bb8d999e77
SHA14d67ea09ce874d20f47e9ab3f53c17492305ff24
SHA2569e9772a268943beb0da6d88571ef31e24f48a3afc183a37ec36009c2724240e4
SHA5122a392e4aaa8b86305a067a109c299892dc13665aef0b4893b15b83a5d573f3066c9539d4d5f1636ab18937e13caf7224f282bdec9ff855fb35d67230cb776634
-
Filesize
174KB
MD52da2f9ae775abd09007e79bb8d999e77
SHA14d67ea09ce874d20f47e9ab3f53c17492305ff24
SHA2569e9772a268943beb0da6d88571ef31e24f48a3afc183a37ec36009c2724240e4
SHA5122a392e4aaa8b86305a067a109c299892dc13665aef0b4893b15b83a5d573f3066c9539d4d5f1636ab18937e13caf7224f282bdec9ff855fb35d67230cb776634
-
Filesize
277KB
MD52b70bf83daf1b8384abea22712618136
SHA13f1cb7260da556707a8c811e1b60df92e7d5bfdb
SHA256431bbdcbbd4990189109ab012fc0f6def6112310cd88d1479703958392a3cae7
SHA512932f1df871da842bf8821cb0887d861e3ff13c4bfc627910e8ea24f061c924b769a61bda30ff20c7eb4190d13bcdd0a0888f3baca7777962fa906964cb7b7f4f
-
Filesize
277KB
MD52b70bf83daf1b8384abea22712618136
SHA13f1cb7260da556707a8c811e1b60df92e7d5bfdb
SHA256431bbdcbbd4990189109ab012fc0f6def6112310cd88d1479703958392a3cae7
SHA512932f1df871da842bf8821cb0887d861e3ff13c4bfc627910e8ea24f061c924b769a61bda30ff20c7eb4190d13bcdd0a0888f3baca7777962fa906964cb7b7f4f
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b