Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe
Resource
win10v2004-20230915-en
General
-
Target
d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe
-
Size
930KB
-
MD5
4697b533d9be35351f1742bb0fa26f94
-
SHA1
06fcdb6fd8172cbcbd27ebb340905d989630475b
-
SHA256
d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b
-
SHA512
93ed2e98d76da352f8c83a1142c11bbcf3ebcf79e38d140fbae14fc1c4a719d8b39bd9fa732de02f09a1273bc9782e9a710c7b40a3f1356acaf411cf8e05a459
-
SSDEEP
12288:gl//yfYb5BIQZVtvffdXWOW1kyOqJ6xM1FKGv4YVnGGwfZhi7p6gA2ni5BVObHWM:YiuBtZvfdGOUkM1fnwG6gAzV+HWi7
Malware Config
Extracted
redline
moner
77.91.124.82:19071
-
auth_value
a94cd9e01643e1945b296c28a2f28707
Signatures
-
Detects Healer an antivirus disabler dropper 1 IoCs
resource yara_rule behavioral2/memory/928-25-0x0000000000400000-0x000000000040A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 4 IoCs
pid Process 4136 x8986038.exe 4532 x4227195.exe 2572 g8567274.exe 2884 i2819572.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" AppLaunch.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x8986038.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x4227195.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1180 set thread context of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 2572 set thread context of 928 2572 g8567274.exe 96 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 928 AppLaunch.exe 928 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 928 AppLaunch.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 1180 wrote to memory of 4472 1180 d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe 91 PID 4472 wrote to memory of 4136 4472 AppLaunch.exe 92 PID 4472 wrote to memory of 4136 4472 AppLaunch.exe 92 PID 4472 wrote to memory of 4136 4472 AppLaunch.exe 92 PID 4136 wrote to memory of 4532 4136 x8986038.exe 93 PID 4136 wrote to memory of 4532 4136 x8986038.exe 93 PID 4136 wrote to memory of 4532 4136 x8986038.exe 93 PID 4532 wrote to memory of 2572 4532 x4227195.exe 94 PID 4532 wrote to memory of 2572 4532 x4227195.exe 94 PID 4532 wrote to memory of 2572 4532 x4227195.exe 94 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 2572 wrote to memory of 928 2572 g8567274.exe 96 PID 4532 wrote to memory of 2884 4532 x4227195.exe 97 PID 4532 wrote to memory of 2884 4532 x4227195.exe 97 PID 4532 wrote to memory of 2884 4532 x4227195.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe"C:\Users\Admin\AppData\Local\Temp\d11b917059b1e85e6e816885c654c6bd9a2a878d05a3ba821bf3bc45baef410b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8986038.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8986038.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4227195.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x4227195.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8567274.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g8567274.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i2819572.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i2819572.exe5⤵
- Executes dropped EXE
PID:2884
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
472KB
MD5c63b754b021f22d2e31e9faeda754ee6
SHA1717142e6abf80c3a400b3304ab0b4a119c8aea09
SHA25637ae7b44b381ca9b619301be2f491829b5140020ee02f0075e9533386aa036f4
SHA5124581ee6a1800b863bfe8fb88854a5d7615267727945b98ab2aff8b70f568c87c242c9ecd1ca9c2c3004b76ace70cf8076f97776401625fcb3dac9356ae6c18ae
-
Filesize
472KB
MD5c63b754b021f22d2e31e9faeda754ee6
SHA1717142e6abf80c3a400b3304ab0b4a119c8aea09
SHA25637ae7b44b381ca9b619301be2f491829b5140020ee02f0075e9533386aa036f4
SHA5124581ee6a1800b863bfe8fb88854a5d7615267727945b98ab2aff8b70f568c87c242c9ecd1ca9c2c3004b76ace70cf8076f97776401625fcb3dac9356ae6c18ae
-
Filesize
306KB
MD5330953ffd7553b1712ba37236d24f750
SHA1e0db633aadbdf6b9f8ba4412ebe65e248252024e
SHA256196186b3852e4a011933f5e8a9a135e3ab5f771ee17faa9b71efde03927da920
SHA5128603f932653a9e47a68a5d8b6ca791c47830f38757565869da01c790038493cf5c61336883f1d300a1e9a247e9eff25c83ffbc3fc36bb14e51f56655c20e526d
-
Filesize
306KB
MD5330953ffd7553b1712ba37236d24f750
SHA1e0db633aadbdf6b9f8ba4412ebe65e248252024e
SHA256196186b3852e4a011933f5e8a9a135e3ab5f771ee17faa9b71efde03927da920
SHA5128603f932653a9e47a68a5d8b6ca791c47830f38757565869da01c790038493cf5c61336883f1d300a1e9a247e9eff25c83ffbc3fc36bb14e51f56655c20e526d
-
Filesize
213KB
MD5b182ca08df3f72499e2b777fdbafd2dc
SHA119751860ed7b8630ec0f0bb9e81957789e5e3dec
SHA256dc921ad418c5ddfe2c0234204d26d60b1e73f0a8af20a2557b6f4671bd40710f
SHA512e9163b36c8a7c0f3a6afa865109c240a1d9eeb39be6b0d0bd83d62aa76b4e230c659f7715c42e1f91bf307b8808724776230716117546342192ea390f2f138df
-
Filesize
213KB
MD5b182ca08df3f72499e2b777fdbafd2dc
SHA119751860ed7b8630ec0f0bb9e81957789e5e3dec
SHA256dc921ad418c5ddfe2c0234204d26d60b1e73f0a8af20a2557b6f4671bd40710f
SHA512e9163b36c8a7c0f3a6afa865109c240a1d9eeb39be6b0d0bd83d62aa76b4e230c659f7715c42e1f91bf307b8808724776230716117546342192ea390f2f138df
-
Filesize
174KB
MD5d4ade93f5eaeff5109ca2c4303b9f723
SHA1827ae8a647bd59c9c449cef78fdd0342fbd1edfe
SHA256a05be92e051850d8a89a36d39857249efd5b73c9030d5188f4707f901b1da3f6
SHA51273bbb687850ccde0220d69e30072f8e7a8ffb1c37a6fec4e714bdf5e94b25941722717eec3af8038ee4115ba0ce889ee791fcc728708c612b102a9a4d4e4fc38
-
Filesize
174KB
MD5d4ade93f5eaeff5109ca2c4303b9f723
SHA1827ae8a647bd59c9c449cef78fdd0342fbd1edfe
SHA256a05be92e051850d8a89a36d39857249efd5b73c9030d5188f4707f901b1da3f6
SHA51273bbb687850ccde0220d69e30072f8e7a8ffb1c37a6fec4e714bdf5e94b25941722717eec3af8038ee4115ba0ce889ee791fcc728708c612b102a9a4d4e4fc38