Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe
Resource
win10v2004-20230915-en
General
-
Target
b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe
-
Size
930KB
-
MD5
188b21bc63faad7b1b3c33af8fe7ba06
-
SHA1
6dbfff80152b0af2473b754c773cc1ccfe63ea49
-
SHA256
b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee
-
SHA512
490fd7b24912c4267ed4944e2b35eb060713e97a5b5f2ee3e2b4173f5dd06c3e542167213a5dccea16e32a426c1539fd1e260550e63699adc1ac873767d1a831
-
SSDEEP
24576:riuBtZGSCFbMmswAMRhEoQlgtSLv1tgkQU4:euBfGSS1sDMRhaGSLv13QU4
Malware Config
Extracted
redline
moner
77.91.124.82:19071
-
auth_value
a94cd9e01643e1945b296c28a2f28707
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral2/memory/4356-25-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 5056 x1816749.exe 4728 x0458196.exe 1496 g5353555.exe 4500 i1433186.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" AppLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1816749.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x0458196.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3888 set thread context of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 1496 set thread context of 4356 1496 g5353555.exe 97 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4356 AppLaunch.exe 4356 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4356 AppLaunch.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 3888 wrote to memory of 1052 3888 b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe 90 PID 1052 wrote to memory of 5056 1052 AppLaunch.exe 93 PID 1052 wrote to memory of 5056 1052 AppLaunch.exe 93 PID 1052 wrote to memory of 5056 1052 AppLaunch.exe 93 PID 5056 wrote to memory of 4728 5056 x1816749.exe 94 PID 5056 wrote to memory of 4728 5056 x1816749.exe 94 PID 5056 wrote to memory of 4728 5056 x1816749.exe 94 PID 4728 wrote to memory of 1496 4728 x0458196.exe 95 PID 4728 wrote to memory of 1496 4728 x0458196.exe 95 PID 4728 wrote to memory of 1496 4728 x0458196.exe 95 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 1496 wrote to memory of 4356 1496 g5353555.exe 97 PID 4728 wrote to memory of 4500 4728 x0458196.exe 98 PID 4728 wrote to memory of 4500 4728 x0458196.exe 98 PID 4728 wrote to memory of 4500 4728 x0458196.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe"C:\Users\Admin\AppData\Local\Temp\b3fe7b1632df8612e97952cc63a296871fb2644a0e890aa8b2369131cdc108ee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1816749.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1816749.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0458196.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x0458196.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5353555.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5353555.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1433186.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1433186.exe5⤵
- Executes dropped EXE
PID:4500
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
MD5c1bd36aed57c05dc59ac4a2a44b44156
SHA1bb5c26e36b3ae8f89b566c09c5279d0581edf3c3
SHA256c1f643a23fe146fac27b0b57aceb7c41837d9cb9fbaa709323d57b0006e41fcc
SHA5122a68fe932efbefd811c76653c8377959b194b820e6e196be5bf39f940b8b24f2f8eb166db064b113b65d9c228b8f2a6820c18c078c351e5831292a7f0e37e610
-
Filesize
472KB
MD5c1bd36aed57c05dc59ac4a2a44b44156
SHA1bb5c26e36b3ae8f89b566c09c5279d0581edf3c3
SHA256c1f643a23fe146fac27b0b57aceb7c41837d9cb9fbaa709323d57b0006e41fcc
SHA5122a68fe932efbefd811c76653c8377959b194b820e6e196be5bf39f940b8b24f2f8eb166db064b113b65d9c228b8f2a6820c18c078c351e5831292a7f0e37e610
-
Filesize
307KB
MD51ce0783cdaa9ab54a21f1a82beae3817
SHA1f30c626cd4826920b7135c1447a840e018a5c217
SHA256b80966e9e26f01c664245d56969b553bad8f0a415387195e3ba16dff08bfdec5
SHA512e4bb7c8124894b3d951d02015e394c3e25b6404dc8659d07f86e306fbb717ced3b4d62a9075d12c823ced7c0864f7f3ff4cb21127a5f3077075d8351d55564f7
-
Filesize
307KB
MD51ce0783cdaa9ab54a21f1a82beae3817
SHA1f30c626cd4826920b7135c1447a840e018a5c217
SHA256b80966e9e26f01c664245d56969b553bad8f0a415387195e3ba16dff08bfdec5
SHA512e4bb7c8124894b3d951d02015e394c3e25b6404dc8659d07f86e306fbb717ced3b4d62a9075d12c823ced7c0864f7f3ff4cb21127a5f3077075d8351d55564f7
-
Filesize
213KB
MD5e7cf11653f6d9cc00bb35125b3bed9c3
SHA1eaff04640937f8395d96ebe65b489b58448eeab4
SHA25616154539bcc4b55d619dfe36fa23283640a6fe8fa8e49d809731808a5e2a669e
SHA51247e850ecb05cac4c1769a10d6767840c2b118bbd5dfdc393229bf09b1693a3384c779908507d4658b28b80860e0ea3e44666e7107e9482e603533394d0520328
-
Filesize
213KB
MD5e7cf11653f6d9cc00bb35125b3bed9c3
SHA1eaff04640937f8395d96ebe65b489b58448eeab4
SHA25616154539bcc4b55d619dfe36fa23283640a6fe8fa8e49d809731808a5e2a669e
SHA51247e850ecb05cac4c1769a10d6767840c2b118bbd5dfdc393229bf09b1693a3384c779908507d4658b28b80860e0ea3e44666e7107e9482e603533394d0520328
-
Filesize
174KB
MD5b25b6b76074d300cb90f6137d0b18374
SHA17c42caf9fca9f7b0f355459e91a4f397da69fd03
SHA2562610321f6481e7e73d7878bb0ed226c225bcca125652fb96c2ff7ae2f5bba8f8
SHA5128883c8de059868ccded6affcd9ce68ac34d3bf4ccc745269cd4431d698a0bdc24f0c308220a77a8d2f7ccd0d522761442e41e520f81f343c9930cb017feff7e7
-
Filesize
174KB
MD5b25b6b76074d300cb90f6137d0b18374
SHA17c42caf9fca9f7b0f355459e91a4f397da69fd03
SHA2562610321f6481e7e73d7878bb0ed226c225bcca125652fb96c2ff7ae2f5bba8f8
SHA5128883c8de059868ccded6affcd9ce68ac34d3bf4ccc745269cd4431d698a0bdc24f0c308220a77a8d2f7ccd0d522761442e41e520f81f343c9930cb017feff7e7