Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 03:44
Static task
static1
Behavioral task
behavioral1
Sample
53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe
Resource
win10v2004-20230915-en
General
-
Target
53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe
-
Size
929KB
-
MD5
1124ffdc20442750558997c977d968ac
-
SHA1
0152b708df9cb8346a9e6304f16feb5191c90a71
-
SHA256
53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c
-
SHA512
54b736562fc16f4ef6436a90b6173c0a59850d24a1124208511ab737e63e75f2561e45fb6e004b62cdbf3d4bcb5a10ec3fab68910c3373750720148d47ac3e18
-
SSDEEP
24576:miuBtZ/sUZyXiu+0WKpWeRpg8QKfo9Ru:1uBfEUZyyu+030e/Q+o3u
Malware Config
Extracted
redline
moner
77.91.124.82:19071
-
auth_value
a94cd9e01643e1945b296c28a2f28707
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral2/memory/4736-25-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 2864 x4387489.exe 1740 x4813095.exe 1480 g0880159.exe 2128 i0424283.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" AppLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x4387489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x4813095.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3232 set thread context of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 1480 set thread context of 4736 1480 g0880159.exe 100 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4736 AppLaunch.exe 4736 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4736 AppLaunch.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 3232 wrote to memory of 1276 3232 53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe 95 PID 1276 wrote to memory of 2864 1276 AppLaunch.exe 96 PID 1276 wrote to memory of 2864 1276 AppLaunch.exe 96 PID 1276 wrote to memory of 2864 1276 AppLaunch.exe 96 PID 2864 wrote to memory of 1740 2864 x4387489.exe 97 PID 2864 wrote to memory of 1740 2864 x4387489.exe 97 PID 2864 wrote to memory of 1740 2864 x4387489.exe 97 PID 1740 wrote to memory of 1480 1740 x4813095.exe 98 PID 1740 wrote to memory of 1480 1740 x4813095.exe 98 PID 1740 wrote to memory of 1480 1740 x4813095.exe 98 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1480 wrote to memory of 4736 1480 g0880159.exe 100 PID 1740 wrote to memory of 2128 1740 x4813095.exe 101 PID 1740 wrote to memory of 2128 1740 x4813095.exe 101 PID 1740 wrote to memory of 2128 1740 x4813095.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe"C:\Users\Admin\AppData\Local\Temp\53aa851ca15b76f3da0f14642124fde2e24db2ce00900e79539c9b72d3e3bf9c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4387489.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x4387489.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4813095.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4813095.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0880159.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g0880159.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0424283.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i0424283.exe5⤵
- Executes dropped EXE
PID:2128
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
MD59b7b81abe81cc3cde1d51e170f6e9554
SHA1579175fad5f685723e780b0c21cfe4a920a490cd
SHA2568b746b0118508ea28a4260975d2d79a6365c8770b938f2bb8951eb16851fcff1
SHA512b6424fbfdfda5492ad3595b9df864df418e265b11148dac186a19c309af28f4b5f5a1e9227d3cf4bd4eb4c44d2ccd40e9e9d2f6664ea90ab906064908c18cfe7
-
Filesize
472KB
MD59b7b81abe81cc3cde1d51e170f6e9554
SHA1579175fad5f685723e780b0c21cfe4a920a490cd
SHA2568b746b0118508ea28a4260975d2d79a6365c8770b938f2bb8951eb16851fcff1
SHA512b6424fbfdfda5492ad3595b9df864df418e265b11148dac186a19c309af28f4b5f5a1e9227d3cf4bd4eb4c44d2ccd40e9e9d2f6664ea90ab906064908c18cfe7
-
Filesize
306KB
MD52f67fd1a463d2a768dfe384c8d7eddf5
SHA1a753d3037b7f8d57455b46d70780df491e75dd0e
SHA25697c66d7e87880e137bfddd168dd5c1d1635f3d24ae0dc5b4ae772ffce2035974
SHA51232b273d0e77f4b23ed017e34135144e9e01bc03314f1774b27f19e79fcdc80b8eeedc1c351ad0175e1ebf91a278efe08bae57a71c886ef17e9f0ee8de9d56c8c
-
Filesize
306KB
MD52f67fd1a463d2a768dfe384c8d7eddf5
SHA1a753d3037b7f8d57455b46d70780df491e75dd0e
SHA25697c66d7e87880e137bfddd168dd5c1d1635f3d24ae0dc5b4ae772ffce2035974
SHA51232b273d0e77f4b23ed017e34135144e9e01bc03314f1774b27f19e79fcdc80b8eeedc1c351ad0175e1ebf91a278efe08bae57a71c886ef17e9f0ee8de9d56c8c
-
Filesize
213KB
MD577bebf94b4effc6eaf7dad6e42bac729
SHA13f66ecea39a28c2c229625e8ed4e509f3d6b0b4e
SHA25650336ac9f1d0db9ea502a7ff454b82fb50bcec66de7311363051ea818747b9ec
SHA512deb79de464b1e2085952a4f417457b9a721a00c9623f8501723c7506acd56b2ddc5aaad3a5c01aa1abbf8c3c7ce83280d045426aa4c7529ac1a627330b840ef8
-
Filesize
213KB
MD577bebf94b4effc6eaf7dad6e42bac729
SHA13f66ecea39a28c2c229625e8ed4e509f3d6b0b4e
SHA25650336ac9f1d0db9ea502a7ff454b82fb50bcec66de7311363051ea818747b9ec
SHA512deb79de464b1e2085952a4f417457b9a721a00c9623f8501723c7506acd56b2ddc5aaad3a5c01aa1abbf8c3c7ce83280d045426aa4c7529ac1a627330b840ef8
-
Filesize
174KB
MD57631ac452bf741f70a3fc1fa550bbd30
SHA1c17dc6f3a2261ad5cdfb6c4f370492ece391157b
SHA2569169ca14209789ad00603601b1ffd8bcb0cd14ce74fbc7e761c78da032c94ab3
SHA5128c9ed4beda4b2601e115a1069fb32941fe04f98d9b7917d38aaa5ed42467134b7a516ecbdab512bf7fbdbd4db4d074da8ec1d96fc863e86953a2c31d9836b529
-
Filesize
174KB
MD57631ac452bf741f70a3fc1fa550bbd30
SHA1c17dc6f3a2261ad5cdfb6c4f370492ece391157b
SHA2569169ca14209789ad00603601b1ffd8bcb0cd14ce74fbc7e761c78da032c94ab3
SHA5128c9ed4beda4b2601e115a1069fb32941fe04f98d9b7917d38aaa5ed42467134b7a516ecbdab512bf7fbdbd4db4d074da8ec1d96fc863e86953a2c31d9836b529