Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe
Resource
win10v2004-20241007-en
General
-
Target
2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe
-
Size
562KB
-
MD5
1a9500015d954217cba644416167ddd5
-
SHA1
87285e82b1b809b4d0a6b8d21953c9b03f7d3c61
-
SHA256
2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc
-
SHA512
18e9cd6f86309d7b2dc59456a952a6367a68efb254a61a6d7c4a23230b6a79b032952a9d654ef216954219009b903d71f66df8aa1ea820eb78cb479221f835fa
-
SSDEEP
12288:DMrMy90uN0shnQrXxeAt4kj5RznGPRC1FD7fTk:zyFhYx/rXzIMXfTk
Malware Config
Extracted
redline
fud
193.233.20.27:4123
-
auth_value
cddc991efd6918ad5321d80dac884b40
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023c9e-13.dat healer behavioral1/memory/1612-15-0x0000000000A70000-0x0000000000A7A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sf28yB44Ct81.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sf28yB44Ct81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sf28yB44Ct81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sf28yB44Ct81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sf28yB44Ct81.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sf28yB44Ct81.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/1524-22-0x0000000007250000-0x0000000007296000-memory.dmp family_redline behavioral1/memory/1524-24-0x00000000072F0000-0x0000000007334000-memory.dmp family_redline behavioral1/memory/1524-30-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-42-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-88-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-86-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-84-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-82-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-80-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-78-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-76-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-72-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-70-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-69-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-66-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-64-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-63-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-60-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-58-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-57-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-54-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-52-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-51-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-48-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-46-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-45-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-40-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-38-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-37-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-35-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-32-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-28-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-74-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-26-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline behavioral1/memory/1524-25-0x00000000072F0000-0x000000000732E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1232 vhjy0216JI.exe 1612 sf28yB44Ct81.exe 1524 tf68Pp49Qv19.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sf28yB44Ct81.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vhjy0216JI.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhjy0216JI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tf68Pp49Qv19.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1612 sf28yB44Ct81.exe 1612 sf28yB44Ct81.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1612 sf28yB44Ct81.exe Token: SeDebugPrivilege 1524 tf68Pp49Qv19.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1676 wrote to memory of 1232 1676 2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe 84 PID 1676 wrote to memory of 1232 1676 2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe 84 PID 1676 wrote to memory of 1232 1676 2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe 84 PID 1232 wrote to memory of 1612 1232 vhjy0216JI.exe 85 PID 1232 wrote to memory of 1612 1232 vhjy0216JI.exe 85 PID 1232 wrote to memory of 1524 1232 vhjy0216JI.exe 94 PID 1232 wrote to memory of 1524 1232 vhjy0216JI.exe 94 PID 1232 wrote to memory of 1524 1232 vhjy0216JI.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe"C:\Users\Admin\AppData\Local\Temp\2f990c9a701879b86041641931c9332939a5ea833af726a653eb6ae07834d4fc.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhjy0216JI.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhjy0216JI.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf28yB44Ct81.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf28yB44Ct81.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf68Pp49Qv19.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf68Pp49Qv19.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
418KB
MD54331c1713a70898336e34bef8f64be84
SHA14b0a8e0b91d422a7b15dc775acb7067166620609
SHA25663a982fdd75ed5248bc1e9f8300db3bcbe2867ca5920acbd9e728bb428b73d18
SHA5128d27eac6b8882d7c1e6faa3fa70cf27c57d7bfa4b0ecbcdfe16876ff4fa2b7ea0be879e5dc903c1c29ae3de0a7f8e864995b45841e9ad1bc918b5a9b43c38d2b
-
Filesize
11KB
MD560f6b342af751b06cb233fa91538006f
SHA1b4055971a9c669798a18426cab7a800ecea907ee
SHA256ed4522161bc53e073a4db6b6333c7ad02aa01b65a141dee2b30a25c94fbfdb4f
SHA512d31ca9ce6cd1721ce939ba1a3864a072936f6d5d8f90baf298ff83db44d8cbb032a582c166b21221c81af67b2ec56b78f6bbe57f88bb0e502e26df91528c5087
-
Filesize
420KB
MD526c4ff23e7d77f037b4cf034354d85b2
SHA1c6596b283bc440832c9baf35453ebc4d9fb70115
SHA25661a27dc04dc6709f1cd05c3b9bd7bae777e915f524decb5948c8cb8f26ff2b19
SHA512c2befc78aa793989b2838803971cd9675a35c1c657a127a69f4bbbd852b77f79df2d733b934d1411b07fe7f01f75359749382be7e8b0c6c9d2b582a5423fc1f9