Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/08/2023, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe
Resource
win10-20230703-en
General
-
Target
a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe
-
Size
731KB
-
MD5
c6478f4fd833829b70fc455a6268d2e1
-
SHA1
a9da3d5e3e715dc491cc3f70ed1707c24a6b6702
-
SHA256
a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624
-
SHA512
5167755c89f0ee8712efa5ed80766069d331722ab114be29feb878e86c40d5f95af7238fc8f6e02fa1d5215424be79544585365ad24ba1d9ef0a4a5a1f02ccd0
-
SSDEEP
12288:EMriy90mCIbvZlSdcHMSmN9E50ah2GXTqykcoZWcCFAkPoAUTSX:uyvTSdcHMSwS5noZP6P4SX
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
dugin
77.91.124.73:19071
-
auth_value
7c3e46e091100fd26a6076996d374c28
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral1/files/0x000700000001b00d-146.dat healer behavioral1/files/0x000700000001b00d-147.dat healer behavioral1/memory/3260-148-0x0000000000D50000-0x0000000000D5A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" l8387849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" l8387849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" l8387849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" l8387849.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" l8387849.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3324 y5755774.exe 3564 y8910175.exe 2484 y2859324.exe 3260 l8387849.exe 4956 m0519474.exe 3736 saves.exe 1308 n6804360.exe 1396 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 4928 rundll32.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" l8387849.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y8910175.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y2859324.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y5755774.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2204 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3260 l8387849.exe 3260 l8387849.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3260 l8387849.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4920 wrote to memory of 3324 4920 a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe 69 PID 4920 wrote to memory of 3324 4920 a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe 69 PID 4920 wrote to memory of 3324 4920 a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe 69 PID 3324 wrote to memory of 3564 3324 y5755774.exe 70 PID 3324 wrote to memory of 3564 3324 y5755774.exe 70 PID 3324 wrote to memory of 3564 3324 y5755774.exe 70 PID 3564 wrote to memory of 2484 3564 y8910175.exe 71 PID 3564 wrote to memory of 2484 3564 y8910175.exe 71 PID 3564 wrote to memory of 2484 3564 y8910175.exe 71 PID 2484 wrote to memory of 3260 2484 y2859324.exe 72 PID 2484 wrote to memory of 3260 2484 y2859324.exe 72 PID 2484 wrote to memory of 4956 2484 y2859324.exe 73 PID 2484 wrote to memory of 4956 2484 y2859324.exe 73 PID 2484 wrote to memory of 4956 2484 y2859324.exe 73 PID 4956 wrote to memory of 3736 4956 m0519474.exe 74 PID 4956 wrote to memory of 3736 4956 m0519474.exe 74 PID 4956 wrote to memory of 3736 4956 m0519474.exe 74 PID 3564 wrote to memory of 1308 3564 y8910175.exe 75 PID 3564 wrote to memory of 1308 3564 y8910175.exe 75 PID 3564 wrote to memory of 1308 3564 y8910175.exe 75 PID 3736 wrote to memory of 2204 3736 saves.exe 76 PID 3736 wrote to memory of 2204 3736 saves.exe 76 PID 3736 wrote to memory of 2204 3736 saves.exe 76 PID 3736 wrote to memory of 2984 3736 saves.exe 78 PID 3736 wrote to memory of 2984 3736 saves.exe 78 PID 3736 wrote to memory of 2984 3736 saves.exe 78 PID 2984 wrote to memory of 4108 2984 cmd.exe 80 PID 2984 wrote to memory of 4108 2984 cmd.exe 80 PID 2984 wrote to memory of 4108 2984 cmd.exe 80 PID 2984 wrote to memory of 1800 2984 cmd.exe 81 PID 2984 wrote to memory of 1800 2984 cmd.exe 81 PID 2984 wrote to memory of 1800 2984 cmd.exe 81 PID 2984 wrote to memory of 3956 2984 cmd.exe 82 PID 2984 wrote to memory of 3956 2984 cmd.exe 82 PID 2984 wrote to memory of 3956 2984 cmd.exe 82 PID 2984 wrote to memory of 1296 2984 cmd.exe 83 PID 2984 wrote to memory of 1296 2984 cmd.exe 83 PID 2984 wrote to memory of 1296 2984 cmd.exe 83 PID 2984 wrote to memory of 3044 2984 cmd.exe 84 PID 2984 wrote to memory of 3044 2984 cmd.exe 84 PID 2984 wrote to memory of 3044 2984 cmd.exe 84 PID 2984 wrote to memory of 1560 2984 cmd.exe 85 PID 2984 wrote to memory of 1560 2984 cmd.exe 85 PID 2984 wrote to memory of 1560 2984 cmd.exe 85 PID 3736 wrote to memory of 4928 3736 saves.exe 86 PID 3736 wrote to memory of 4928 3736 saves.exe 86 PID 3736 wrote to memory of 4928 3736 saves.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe"C:\Users\Admin\AppData\Local\Temp\a67b07892cb873446ca6508b6839a665860e78ae2e7796ba0f071592ac0eb624.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5755774.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y5755774.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8910175.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8910175.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2859324.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y2859324.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l8387849.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l8387849.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3260
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m0519474.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m0519474.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:2204
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:4108
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:1800
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:3956
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:1296
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:3044
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:1560
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4928
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6804360.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6804360.exe4⤵
- Executes dropped EXE
PID:1308
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1396
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
598KB
MD531e07aa0b03525a25f4df9a5102a555e
SHA1afc9882dade563d3dd01d3be45cb847079342170
SHA256f2b1b924d3cc6320cf5445b39c7e686a1324c7c5429fb4f9fd1ee1e65bac0b99
SHA5128174827f576217ae83f508ee962a3ed7efc5e52235015356a242b6e1e990ba34e17badaa2fb23617b41654853569d65843e511a4dcceffdaa5df155a69c7feb8
-
Filesize
598KB
MD531e07aa0b03525a25f4df9a5102a555e
SHA1afc9882dade563d3dd01d3be45cb847079342170
SHA256f2b1b924d3cc6320cf5445b39c7e686a1324c7c5429fb4f9fd1ee1e65bac0b99
SHA5128174827f576217ae83f508ee962a3ed7efc5e52235015356a242b6e1e990ba34e17badaa2fb23617b41654853569d65843e511a4dcceffdaa5df155a69c7feb8
-
Filesize
432KB
MD53edcd9d6413bda4ed2cdc93a78ba2458
SHA13e8cdff14f37cc9487184f9653af9d50ad483253
SHA256d44d4d63cbea8da42b47d417fe5e9f2261f723169f2d703da1dde1bd9214c9ef
SHA512fde519d8ee374250210d9432d9b6c19523c6def1cfb60f14363253b6d87a4cf8d0c0a6f4b3b9ac80f0bc7eb18574ad217be60013daaf0b66e8ee64e791e80bc9
-
Filesize
432KB
MD53edcd9d6413bda4ed2cdc93a78ba2458
SHA13e8cdff14f37cc9487184f9653af9d50ad483253
SHA256d44d4d63cbea8da42b47d417fe5e9f2261f723169f2d703da1dde1bd9214c9ef
SHA512fde519d8ee374250210d9432d9b6c19523c6def1cfb60f14363253b6d87a4cf8d0c0a6f4b3b9ac80f0bc7eb18574ad217be60013daaf0b66e8ee64e791e80bc9
-
Filesize
173KB
MD5a768f5aa146d6bd2a5353eeb335ded79
SHA183ce56182aaa25c766210e179e208d1e9ab62eb4
SHA256b4fac6d87c98698ed4ed18fe7ed2c0ccb65f9a1217ba620de0ca661c8ebbd49a
SHA512be3a0f4e86cd3eb4ac8586da2195570432f9f4a9775cb6ba372278d844ba7f2a7ffe2ecb52c7dd76c87cd626aeb9a4627efab7001f548c724e339e9818f2a6cf
-
Filesize
173KB
MD5a768f5aa146d6bd2a5353eeb335ded79
SHA183ce56182aaa25c766210e179e208d1e9ab62eb4
SHA256b4fac6d87c98698ed4ed18fe7ed2c0ccb65f9a1217ba620de0ca661c8ebbd49a
SHA512be3a0f4e86cd3eb4ac8586da2195570432f9f4a9775cb6ba372278d844ba7f2a7ffe2ecb52c7dd76c87cd626aeb9a4627efab7001f548c724e339e9818f2a6cf
-
Filesize
277KB
MD544d013d20298998d15a877bf8e87f7ae
SHA1564e995f304b34a8fe15e7d345421ea16d5a4aad
SHA256139a6b929c33f25a3845eba7e08db62c8a59af695022320ac149cc27669ada4f
SHA512b9206b3e609e468c6a2d58b97d2f59b6e11b2eeae886258db8234e582df02f02cbd32e6fef074adf10c1de605084a0691292b7bf86b7002bda4625174c37e0df
-
Filesize
277KB
MD544d013d20298998d15a877bf8e87f7ae
SHA1564e995f304b34a8fe15e7d345421ea16d5a4aad
SHA256139a6b929c33f25a3845eba7e08db62c8a59af695022320ac149cc27669ada4f
SHA512b9206b3e609e468c6a2d58b97d2f59b6e11b2eeae886258db8234e582df02f02cbd32e6fef074adf10c1de605084a0691292b7bf86b7002bda4625174c37e0df
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b