Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230831-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/09/2023, 05:12

General

  • Target

    c33db0df2a0ba843176dfaf8a0277f9e3640056dd9539d56103929bc46b9bf08.exe

  • Size

    930KB

  • MD5

    4eed99a25e71ac5564127defdb2ba0d4

  • SHA1

    96e7d6aabe5dd29ccc47b92038b50fd2f1a04bf2

  • SHA256

    c33db0df2a0ba843176dfaf8a0277f9e3640056dd9539d56103929bc46b9bf08

  • SHA512

    c34447641117c72c9ca9581485a8ea11a3f2f5c210fb404063b46a9027628059865ebcf3025fd4c371b2634998bfc6931a0c216b324a03cf5c789e43669bb2ca

  • SSDEEP

    24576:ByXAxGYxE5zFEBeBX8PMIVQh0yoxhDPOB3G5t:0XJYxiFEeX8PpTN5Wc5

Malware Config

Extracted

Family

redline

Botnet

jang

C2

77.91.124.82:19071

Attributes
  • auth_value

    662102010afcbe9e22b13116b1c1a088

Signatures

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 7 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c33db0df2a0ba843176dfaf8a0277f9e3640056dd9539d56103929bc46b9bf08.exe
    "C:\Users\Admin\AppData\Local\Temp\c33db0df2a0ba843176dfaf8a0277f9e3640056dd9539d56103929bc46b9bf08.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1520346.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1520346.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9235571.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9235571.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4360
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0360909.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0360909.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1684
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5482980.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5482980.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:5104
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4159494.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4159494.exe
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Executes dropped EXE
              • Windows security modification
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1788
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8229073.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8229073.exe
              6⤵
              • Executes dropped EXE
              PID:2032
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2620502.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2620502.exe
            5⤵
            • Executes dropped EXE
            PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1520346.exe

    Filesize

    824KB

    MD5

    96517e0a71b136fba578a225c3716087

    SHA1

    e68e7bb8f43e52ea2e17a3ac86f697c07c3261c0

    SHA256

    f31d109ba1f17ab091a47bbd08a284c5fb1c238b833e74b09698abe5be96f5dd

    SHA512

    776d423d9efc2155b1c29d97450bdbb7a8316a8776aa4a9d89ce66192b869caa99aef619bcad9b2ade1944ce49549fbf00c7629eeb0eb23d7a624a83f81b2d2f

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1520346.exe

    Filesize

    824KB

    MD5

    96517e0a71b136fba578a225c3716087

    SHA1

    e68e7bb8f43e52ea2e17a3ac86f697c07c3261c0

    SHA256

    f31d109ba1f17ab091a47bbd08a284c5fb1c238b833e74b09698abe5be96f5dd

    SHA512

    776d423d9efc2155b1c29d97450bdbb7a8316a8776aa4a9d89ce66192b869caa99aef619bcad9b2ade1944ce49549fbf00c7629eeb0eb23d7a624a83f81b2d2f

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9235571.exe

    Filesize

    598KB

    MD5

    e634679bb3d676adac8d423246ff34c6

    SHA1

    cc7ee399631f1fa6c30a6b5cbb6cc7ddc1060dfc

    SHA256

    605dd5a6b9ce88eee933541fea0fa74520b9609330915ec89ea4d15cf7c1f7e2

    SHA512

    20f37265e16dba9139620676587cde32fcdd6f6ace689c3558348d23cf8aac993d4031c7cc2fb6b4d5bc3ac7ca38c8df67dd4f6afae2c9744a4a1850e63cf0dd

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9235571.exe

    Filesize

    598KB

    MD5

    e634679bb3d676adac8d423246ff34c6

    SHA1

    cc7ee399631f1fa6c30a6b5cbb6cc7ddc1060dfc

    SHA256

    605dd5a6b9ce88eee933541fea0fa74520b9609330915ec89ea4d15cf7c1f7e2

    SHA512

    20f37265e16dba9139620676587cde32fcdd6f6ace689c3558348d23cf8aac993d4031c7cc2fb6b4d5bc3ac7ca38c8df67dd4f6afae2c9744a4a1850e63cf0dd

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0360909.exe

    Filesize

    372KB

    MD5

    5a953ce502cec428cf42153ba592479f

    SHA1

    682f598b94004a21fb939b3919dcea5ae0fe0ee7

    SHA256

    167d50fbc284550d7093518c4d5796d485c4bb5d142dc4b1ce21131708128ce6

    SHA512

    5c39745c368fcc45782025ccb4bfc519ef853c035585aeedc63d238b23f052368dc21257c7cae1c9fb5c6ba935d948a374ad50fcac670accfcdc0cec608fecda

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0360909.exe

    Filesize

    372KB

    MD5

    5a953ce502cec428cf42153ba592479f

    SHA1

    682f598b94004a21fb939b3919dcea5ae0fe0ee7

    SHA256

    167d50fbc284550d7093518c4d5796d485c4bb5d142dc4b1ce21131708128ce6

    SHA512

    5c39745c368fcc45782025ccb4bfc519ef853c035585aeedc63d238b23f052368dc21257c7cae1c9fb5c6ba935d948a374ad50fcac670accfcdc0cec608fecda

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2620502.exe

    Filesize

    174KB

    MD5

    a985dd3dc5c3fc50a041d8735d94774d

    SHA1

    6d2153a91c81161bf3053c38b11906eb940cd843

    SHA256

    e1197d589ae86c46c4958d10700c48302c654fffefdc931b7c7f6835dd6cd394

    SHA512

    056c67a889dcec9206f4ab7caebb8405d03a69124594385cbc3295402f9d5fbb4e3d145262023d027c52e7fb9ce604f8e686ceeb7880952b6d7e47d4a0b1b6d4

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2620502.exe

    Filesize

    174KB

    MD5

    a985dd3dc5c3fc50a041d8735d94774d

    SHA1

    6d2153a91c81161bf3053c38b11906eb940cd843

    SHA256

    e1197d589ae86c46c4958d10700c48302c654fffefdc931b7c7f6835dd6cd394

    SHA512

    056c67a889dcec9206f4ab7caebb8405d03a69124594385cbc3295402f9d5fbb4e3d145262023d027c52e7fb9ce604f8e686ceeb7880952b6d7e47d4a0b1b6d4

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5482980.exe

    Filesize

    217KB

    MD5

    6705c6cc2801fdbe04e9ab828e7ea15d

    SHA1

    4f77c413a522e8b163d5ad0ef5c54c2d7ca5206e

    SHA256

    59876b0691f9a36c282060610d851efe8e1fbc236b7be78f4397ea3fe9756867

    SHA512

    30f0fdfa957918e89d8af10b49426a6ac0de4094351157bda02c2f38ad51034e87718d0b063a277e693ff0a83864f38c099b1293e5f424aaeb56f94454ca0e02

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5482980.exe

    Filesize

    217KB

    MD5

    6705c6cc2801fdbe04e9ab828e7ea15d

    SHA1

    4f77c413a522e8b163d5ad0ef5c54c2d7ca5206e

    SHA256

    59876b0691f9a36c282060610d851efe8e1fbc236b7be78f4397ea3fe9756867

    SHA512

    30f0fdfa957918e89d8af10b49426a6ac0de4094351157bda02c2f38ad51034e87718d0b063a277e693ff0a83864f38c099b1293e5f424aaeb56f94454ca0e02

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4159494.exe

    Filesize

    19KB

    MD5

    cb3b949c583fef756a1b54f04d1fb0cd

    SHA1

    01d17a65275555021491d38e087d14cc565b0432

    SHA256

    b400e57897dfe1670392c05cdf8e4dd79243a67a187bd30500695f9254561740

    SHA512

    e4d501792bffaee9ecad46a81da3d8e9589abce65fc12a624743bca65d13b6239216ded3c5a2576fbff1e814b932153244f101f94df5f33353f679827f6ceef7

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4159494.exe

    Filesize

    19KB

    MD5

    cb3b949c583fef756a1b54f04d1fb0cd

    SHA1

    01d17a65275555021491d38e087d14cc565b0432

    SHA256

    b400e57897dfe1670392c05cdf8e4dd79243a67a187bd30500695f9254561740

    SHA512

    e4d501792bffaee9ecad46a81da3d8e9589abce65fc12a624743bca65d13b6239216ded3c5a2576fbff1e814b932153244f101f94df5f33353f679827f6ceef7

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8229073.exe

    Filesize

    141KB

    MD5

    62e47c8cefa185bb6e6155e50827bc89

    SHA1

    7591afed0026ccde4f0aa6177eaed875feff9b3f

    SHA256

    30f8eb1c836657be5629fd81683e33cfbfa07724cc130e2eb4f0aac4a03a809e

    SHA512

    685cc7cfcbb1728a3a7d62aead05dffa3e72fb69af7492bb2b00ddd261e876dbc97f46905c112dc097796edf0ce10dc3dc5547275222c86bd6418022a228a23f

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8229073.exe

    Filesize

    141KB

    MD5

    62e47c8cefa185bb6e6155e50827bc89

    SHA1

    7591afed0026ccde4f0aa6177eaed875feff9b3f

    SHA256

    30f8eb1c836657be5629fd81683e33cfbfa07724cc130e2eb4f0aac4a03a809e

    SHA512

    685cc7cfcbb1728a3a7d62aead05dffa3e72fb69af7492bb2b00ddd261e876dbc97f46905c112dc097796edf0ce10dc3dc5547275222c86bd6418022a228a23f

  • memory/1788-38-0x00007FF957E40000-0x00007FF958901000-memory.dmp

    Filesize

    10.8MB

  • memory/1788-36-0x00007FF957E40000-0x00007FF958901000-memory.dmp

    Filesize

    10.8MB

  • memory/1788-35-0x0000000000D00000-0x0000000000D0A000-memory.dmp

    Filesize

    40KB

  • memory/2772-45-0x00000000006A0000-0x00000000006D0000-memory.dmp

    Filesize

    192KB

  • memory/2772-46-0x0000000074070000-0x0000000074820000-memory.dmp

    Filesize

    7.7MB

  • memory/2772-47-0x0000000005840000-0x0000000005E58000-memory.dmp

    Filesize

    6.1MB

  • memory/2772-48-0x0000000005330000-0x000000000543A000-memory.dmp

    Filesize

    1.0MB

  • memory/2772-49-0x0000000005210000-0x0000000005220000-memory.dmp

    Filesize

    64KB

  • memory/2772-50-0x0000000005160000-0x0000000005172000-memory.dmp

    Filesize

    72KB

  • memory/2772-51-0x00000000051C0000-0x00000000051FC000-memory.dmp

    Filesize

    240KB

  • memory/2772-52-0x0000000074070000-0x0000000074820000-memory.dmp

    Filesize

    7.7MB

  • memory/2772-53-0x0000000005210000-0x0000000005220000-memory.dmp

    Filesize

    64KB