Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
305b48b2909...29.exe
windows10-2004-x64
1018c3050e5a...e4.exe
windows10-2004-x64
102577bd2a22...1d.exe
windows10-2004-x64
1028839ba22b...c4.exe
windows10-2004-x64
104efca8805f...a2.exe
windows10-2004-x64
106603f1832a...ef.exe
windows10-2004-x64
106ba0db3b66...b3.exe
windows10-2004-x64
1074fe770b34...18.exe
windows10-2004-x64
10b6b53c7022...c9.exe
windows10-2004-x64
10eedc883713...91.exe
windows10-2004-x64
10Analysis
-
max time kernel
136s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
05b48b2909386e117184a0bdde8c6718992cf21d07674042c9d076292b260729.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
18c3050e5ad727d8fc6d2b16a53db9904ba34d7413ce2abfe2cd0baa2cd5dce4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
2577bd2a22a0df03082a3d61b193668ccfa94a1aef60cb7bb0a7a5123c552c1d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
28839ba22be16cab09b3664b34397e918be834c1459cde49048ffd421d2876c4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
4efca8805f96c16e636fc6f51197b43215b96da00409608d7658fea7ee155ea2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
6603f1832a5054b7e8305ef7814111e74fc6f8356ae86cc81f0bd306722236ef.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
6ba0db3b66f5f3df269e1eb1b3241575d1ec8d58b19767274aae0af44946bbb3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
74fe770b3414b7af5432877eaaf1d2520b875a38c461d63983c77f7c1b39d918.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
eedc883713775fd0c74224f0bedec2b1e88a105737c823318fc8ba819901d991.exe
Resource
win10v2004-20240508-en
General
-
Target
b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe
-
Size
1.2MB
-
MD5
3084e5a05ec994a172379bb42d1f4a6e
-
SHA1
d5705086a050a075520d1e19aa047f924e079ba5
-
SHA256
b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9
-
SHA512
7988b8ced595a143db70f1e668bb0e645fa19621e363061379cd5b042ec6444bf8f9a14184bd65afb126a851e8acfb23eee6f71bce930d135c9eab36d87e06a0
-
SSDEEP
24576:my9QoTLxsXrQ8m0Y3lsvmLEBXibYVetVVosYmmL9hK:19Qwss8ytLqqYjsJmJh
Malware Config
Extracted
redline
lamp
77.91.68.56:19071
-
auth_value
ee1df63bcdbe3de70f52810d94eaff7d
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
resource yara_rule behavioral9/memory/4392-41-0x00000000007D0000-0x000000000080E000-memory.dmp healer behavioral9/files/0x0007000000023456-46.dat healer behavioral9/memory/2216-48-0x0000000000560000-0x000000000056A000-memory.dmp healer -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" a6918678.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection b0194431.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" b0194431.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" b0194431.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" b0194431.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" b0194431.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" b0194431.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral9/memory/1384-53-0x0000000001FF0000-0x000000000207C000-memory.dmp family_redline behavioral9/memory/1384-60-0x0000000001FF0000-0x000000000207C000-memory.dmp family_redline -
Executes dropped EXE 7 IoCs
pid Process 864 v8193530.exe 4172 v7356747.exe 748 v1869910.exe 3136 v6266876.exe 4392 a6918678.exe 2216 b0194431.exe 1384 c9863785.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" a6918678.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" b0194431.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" v8193530.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" v7356747.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" v1869910.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" v6266876.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4392 a6918678.exe 4392 a6918678.exe 2216 b0194431.exe 2216 b0194431.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4392 a6918678.exe Token: SeDebugPrivilege 2216 b0194431.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1808 wrote to memory of 864 1808 b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe 83 PID 1808 wrote to memory of 864 1808 b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe 83 PID 1808 wrote to memory of 864 1808 b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe 83 PID 864 wrote to memory of 4172 864 v8193530.exe 84 PID 864 wrote to memory of 4172 864 v8193530.exe 84 PID 864 wrote to memory of 4172 864 v8193530.exe 84 PID 4172 wrote to memory of 748 4172 v7356747.exe 86 PID 4172 wrote to memory of 748 4172 v7356747.exe 86 PID 4172 wrote to memory of 748 4172 v7356747.exe 86 PID 748 wrote to memory of 3136 748 v1869910.exe 87 PID 748 wrote to memory of 3136 748 v1869910.exe 87 PID 748 wrote to memory of 3136 748 v1869910.exe 87 PID 3136 wrote to memory of 4392 3136 v6266876.exe 88 PID 3136 wrote to memory of 4392 3136 v6266876.exe 88 PID 3136 wrote to memory of 4392 3136 v6266876.exe 88 PID 3136 wrote to memory of 2216 3136 v6266876.exe 96 PID 3136 wrote to memory of 2216 3136 v6266876.exe 96 PID 748 wrote to memory of 1384 748 v1869910.exe 97 PID 748 wrote to memory of 1384 748 v1869910.exe 97 PID 748 wrote to memory of 1384 748 v1869910.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe"C:\Users\Admin\AppData\Local\Temp\b6b53c7022ec83f58037dc5fee6d8a5dd71ff675b2851d1ebdaac02d608ebac9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8193530.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8193530.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7356747.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7356747.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1869910.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v1869910.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6266876.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6266876.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6918678.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a6918678.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4392
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0194431.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b0194431.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9863785.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c9863785.exe5⤵
- Executes dropped EXE
PID:1384
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
1.0MB
MD58f452b4a4326c38e4571b85753f14835
SHA139e82691dbf838c5929a85c0ccea571b2eeaa762
SHA2562c425603871cfae47a16427da45eb520a5ed3d232c7cd61f40106132368da097
SHA5125a562cd0ba0c785afe7121fd99bc39173a2121452c011bdb7424ffe30c95e181d4848dbe70996f40d02e03518328159b8913ae7351cfb4da9d4da1b4cd36a061
-
Filesize
905KB
MD5c01e50a9b08254b6225359b71398aec4
SHA169290aa4f0cfff274bd47cbea733cd1494329fff
SHA256e11371b57008d6851d429072eb585f23a66ef95ba1f2fe63bd2ee922b8583a12
SHA51273b878812254dbf5854e5cd330bcb063eca437b2f84b127f6f8fae664d274b3de5904a97ea070c77f32fe3838d69926aa7e9f19d3abaa4b81cc8684c9acc0b5d
-
Filesize
722KB
MD5b047020daecfcd4d6486280843970ca3
SHA11126405fb85088855aa5c5b0a4fe8c53deff0d25
SHA2566347410a710cfe628661defb8efdb525f50735c3eeb0911a1b4c40888708bab8
SHA51278d6bbedafae407382fb5e27982c03d04c8036406742168203577974d0632915125324292665ff07e82ef42faeca5a24add5ac0ccf0ac7a5ced4152bfad44a65
-
Filesize
492KB
MD5c0cb72fd5b63fa6a0e23311a69b60989
SHA1bc1d486836b34d78d9169fec03e4b60433e1374c
SHA256875aa2484a1a2abf76d5e4888f69df5ef6eac968473931e34bfd7a571eaa3a1d
SHA512a469239d9e7178b1127af703d1347670173ec45f446bc47e96b1edc8f6ecc1482de44d055a9183b8e9f441a9b0d1625da2b48d36392c919ca5be3ad6f542c805
-
Filesize
325KB
MD53700b23c6984dc6b04ae254478422acf
SHA1c96f67a6cd8c1c5c421a2f7268fdb0cbbcf5969d
SHA25653432dba21043cefad2ee82a5077c1aea9238fa7a57f8701799c03717b27b344
SHA5125c9b84a799ae5178ff835fb31e8a9b986bd923fc6fa5d13aff1df33ed66f0eea4826066ec741b04deafd5370a08dbdf154668c3dfde2177c9b1378198fb1ce75
-
Filesize
295KB
MD552a2bfba5bb378ef0d888bff0a0a9a4c
SHA1e407c2042a2751b2643c4ba379b37f5c98242c07
SHA25646aedf9813ed0c38fac92d5493e5dde9b57dbc6304456fc2ececa49e07feed65
SHA512cd46b3f4f4165ddc64c3c87ad8ef0b855c032e8ecb863092b9fb08cd5885a31178f8538dfd447c4e0848cdf09cd7e2ce4e972c2ac4719cb60dd5c36ae8713ec8
-
Filesize
11KB
MD5a489f76b1e20676c44e20a1265d95bd2
SHA14adea8e3285c282db000d943bb98a5a7b9f797b7
SHA2564c2d887e30ef21d4754b422f989dd02647ffd5ecfeea4342034e646e914ea32d
SHA51206b205ec385ac02692a039cff628c8c5dcc4d1e388a05d4bdc8ad6b7f6efc61a3caf8c9bd9f18d08f321a4e11d27932af8a0ca8bc60bf62d2dbf0a8075bbcfa3