Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2023, 02:27

General

  • Target

    b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe

  • Size

    930KB

  • MD5

    188b21bc63faad7b1b3c33af8fe7ba06

  • SHA1

    6dbfff80152b0af2473b754c773cc1ccfe63ea49

  • SHA256

    b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee

  • SHA512

    490fd7b24912c4267ed4944e2b35eb060713e97a5b5f2ee3e2b4173f5dd06c3e542167213a5dccea16e32a426c1539fd1e260550e63699adc1ac873767d1a831

  • SSDEEP

    24576:riuBtZGSCFbMmswAMRhEoQlgtSLv1tgkQU4:euBfGSS1sDMRhaGSLv13QU4

Malware Config

Extracted

Family

redline

Botnet

moner

C2

77.91.124.82:19071

Attributes
  • auth_value

    a94cd9e01643e1945b296c28a2f28707

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe
    "C:\Users\Admin\AppData\Local\Temp\b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1052
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1816749.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1816749.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:5056
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0458196.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0458196.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4728
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5353555.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5353555.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Modifies Windows Defender Real-time Protection settings
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4356
          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1433186.exe
            C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1433186.exe
            5⤵
            • Executes dropped EXE
            PID:4500

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1816749.exe

    Filesize

    472KB

    MD5

    c1bd36aed57c05dc59ac4a2a44b44156

    SHA1

    bb5c26e36b3ae8f89b566c09c5279d0581edf3c3

    SHA256

    c1f643a23fe146fac27b0b57aceb7c41837d9cb9fbaa709323d57b0006e41fcc

    SHA512

    2a68fe932efbefd811c76653c8377959b194b820e6e196be5bf39f940b8b24f2f8eb166db064b113b65d9c228b8f2a6820c18c078c351e5831292a7f0e37e610

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1816749.exe

    Filesize

    472KB

    MD5

    c1bd36aed57c05dc59ac4a2a44b44156

    SHA1

    bb5c26e36b3ae8f89b566c09c5279d0581edf3c3

    SHA256

    c1f643a23fe146fac27b0b57aceb7c41837d9cb9fbaa709323d57b0006e41fcc

    SHA512

    2a68fe932efbefd811c76653c8377959b194b820e6e196be5bf39f940b8b24f2f8eb166db064b113b65d9c228b8f2a6820c18c078c351e5831292a7f0e37e610

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0458196.exe

    Filesize

    307KB

    MD5

    1ce0783cdaa9ab54a21f1a82beae3817

    SHA1

    f30c626cd4826920b7135c1447a840e018a5c217

    SHA256

    b80966e9e26f01c664245d56969b553bad8f0a415387195e3ba16dff08bfdec5

    SHA512

    e4bb7c8124894b3d951d02015e394c3e25b6404dc8659d07f86e306fbb717ced3b4d62a9075d12c823ced7c0864f7f3ff4cb21127a5f3077075d8351d55564f7

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0458196.exe

    Filesize

    307KB

    MD5

    1ce0783cdaa9ab54a21f1a82beae3817

    SHA1

    f30c626cd4826920b7135c1447a840e018a5c217

    SHA256

    b80966e9e26f01c664245d56969b553bad8f0a415387195e3ba16dff08bfdec5

    SHA512

    e4bb7c8124894b3d951d02015e394c3e25b6404dc8659d07f86e306fbb717ced3b4d62a9075d12c823ced7c0864f7f3ff4cb21127a5f3077075d8351d55564f7

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5353555.exe

    Filesize

    213KB

    MD5

    e7cf11653f6d9cc00bb35125b3bed9c3

    SHA1

    eaff04640937f8395d96ebe65b489b58448eeab4

    SHA256

    16154539bcc4b55d619dfe36fa23283640a6fe8fa8e49d809731808a5e2a669e

    SHA512

    47e850ecb05cac4c1769a10d6767840c2b118bbd5dfdc393229bf09b1693a3384c779908507d4658b28b80860e0ea3e44666e7107e9482e603533394d0520328

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5353555.exe

    Filesize

    213KB

    MD5

    e7cf11653f6d9cc00bb35125b3bed9c3

    SHA1

    eaff04640937f8395d96ebe65b489b58448eeab4

    SHA256

    16154539bcc4b55d619dfe36fa23283640a6fe8fa8e49d809731808a5e2a669e

    SHA512

    47e850ecb05cac4c1769a10d6767840c2b118bbd5dfdc393229bf09b1693a3384c779908507d4658b28b80860e0ea3e44666e7107e9482e603533394d0520328

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1433186.exe

    Filesize

    174KB

    MD5

    b25b6b76074d300cb90f6137d0b18374

    SHA1

    7c42caf9fca9f7b0f355459e91a4f397da69fd03

    SHA256

    2610321f6481e7e73d7878bb0ed226c225bcca125652fb96c2ff7ae2f5bba8f8

    SHA512

    8883c8de059868ccded6affcd9ce68ac34d3bf4ccc745269cd4431d698a0bdc24f0c308220a77a8d2f7ccd0d522761442e41e520f81f343c9930cb017feff7e7

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1433186.exe

    Filesize

    174KB

    MD5

    b25b6b76074d300cb90f6137d0b18374

    SHA1

    7c42caf9fca9f7b0f355459e91a4f397da69fd03

    SHA256

    2610321f6481e7e73d7878bb0ed226c225bcca125652fb96c2ff7ae2f5bba8f8

    SHA512

    8883c8de059868ccded6affcd9ce68ac34d3bf4ccc745269cd4431d698a0bdc24f0c308220a77a8d2f7ccd0d522761442e41e520f81f343c9930cb017feff7e7

  • memory/1052-3-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/1052-2-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/1052-1-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/1052-33-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/1052-0-0x0000000000400000-0x00000000004BB000-memory.dmp

    Filesize

    748KB

  • memory/4356-25-0x0000000000400000-0x000000000040A000-memory.dmp

    Filesize

    40KB

  • memory/4356-43-0x0000000074050000-0x0000000074800000-memory.dmp

    Filesize

    7.7MB

  • memory/4356-31-0x0000000074050000-0x0000000074800000-memory.dmp

    Filesize

    7.7MB

  • memory/4356-35-0x0000000074050000-0x0000000074800000-memory.dmp

    Filesize

    7.7MB

  • memory/4500-30-0x0000000074050000-0x0000000074800000-memory.dmp

    Filesize

    7.7MB

  • memory/4500-34-0x0000000074050000-0x0000000074800000-memory.dmp

    Filesize

    7.7MB

  • memory/4500-32-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/4500-36-0x0000000005F70000-0x0000000006588000-memory.dmp

    Filesize

    6.1MB

  • memory/4500-37-0x0000000005A60000-0x0000000005B6A000-memory.dmp

    Filesize

    1.0MB

  • memory/4500-38-0x0000000005840000-0x0000000005850000-memory.dmp

    Filesize

    64KB

  • memory/4500-39-0x0000000005990000-0x00000000059A2000-memory.dmp

    Filesize

    72KB

  • memory/4500-40-0x00000000059F0000-0x0000000005A2C000-memory.dmp

    Filesize

    240KB

  • memory/4500-41-0x0000000005B70000-0x0000000005BBC000-memory.dmp

    Filesize

    304KB

  • memory/4500-29-0x0000000000EC0000-0x0000000000EF0000-memory.dmp

    Filesize

    192KB

  • memory/4500-44-0x0000000005840000-0x0000000005850000-memory.dmp

    Filesize

    64KB