Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/11/2024, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe
Resource
win10v2004-20241007-en
General
-
Target
e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe
-
Size
533KB
-
MD5
3b5ff9f6a10459e92462ccaaf6100d7a
-
SHA1
ecb96b6dfdc473461969bb960690befe224021ab
-
SHA256
e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42
-
SHA512
ee221234b7d74c691f236fdfbe40c2565d87a9522f29636cb09ad06bb2eca1b8106204f4c60ca72087a8d76534a1ed0690e6dfe68ff50bf7aa5fe85306feee65
-
SSDEEP
12288:RMrBy90o3j4uPBZ+yd19xRHL0c8NBjsccXt3B:AyZ0uPB/bRHLX8bzA
Malware Config
Extracted
redline
rumfa
193.233.20.24:4123
-
auth_value
749d02a6b4ef1fa2ad908e44ec2296dc
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023cac-12.dat healer behavioral1/memory/2292-15-0x00000000009B0000-0x00000000009BA000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sw78ph90Pb59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sw78ph90Pb59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sw78ph90Pb59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sw78ph90Pb59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sw78ph90Pb59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sw78ph90Pb59.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/3288-22-0x0000000002260000-0x00000000022A6000-memory.dmp family_redline behavioral1/memory/3288-24-0x00000000026B0000-0x00000000026F4000-memory.dmp family_redline behavioral1/memory/3288-46-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-50-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-88-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-86-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-82-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-80-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-78-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-74-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-72-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-70-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-68-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-66-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-62-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-60-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-58-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-56-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-54-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-52-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-48-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-44-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-42-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-40-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-38-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-36-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-32-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-84-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-76-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-64-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-34-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-30-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-28-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-26-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline behavioral1/memory/3288-25-0x00000000026B0000-0x00000000026EE000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 4056 vax7416gv.exe 2292 sw78ph90Pb59.exe 3288 tUr69ZF48.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sw78ph90Pb59.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vax7416gv.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vax7416gv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tUr69ZF48.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2292 sw78ph90Pb59.exe 2292 sw78ph90Pb59.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2292 sw78ph90Pb59.exe Token: SeDebugPrivilege 3288 tUr69ZF48.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3172 wrote to memory of 4056 3172 e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe 84 PID 3172 wrote to memory of 4056 3172 e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe 84 PID 3172 wrote to memory of 4056 3172 e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe 84 PID 4056 wrote to memory of 2292 4056 vax7416gv.exe 85 PID 4056 wrote to memory of 2292 4056 vax7416gv.exe 85 PID 4056 wrote to memory of 3288 4056 vax7416gv.exe 93 PID 4056 wrote to memory of 3288 4056 vax7416gv.exe 93 PID 4056 wrote to memory of 3288 4056 vax7416gv.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe"C:\Users\Admin\AppData\Local\Temp\e89ab992f0b892b67553bdcf3fdf6216bb7e27ea88a7dd2b71a824e954bdde42.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vax7416gv.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vax7416gv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw78ph90Pb59.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sw78ph90Pb59.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tUr69ZF48.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tUr69ZF48.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3288
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
389KB
MD59b9e37bad816b581ee6780b5e0f34723
SHA119e8336be13248c0ca6eafae275a0c3d49494dcc
SHA2562766cc6121384f1b601b1cc4fe15d7f469f1bfbd628e51fcbcd11d8414c19656
SHA5123aee59992dc88eb9cefe9988bea3277cc4b9cd9c9b773a49e989611d34b91876b7cd04815d06670838f82e69a624527ebfe9744331700a30e6cdffb1a7038e14
-
Filesize
11KB
MD5ef6b98c54fa02e1487259cac061bd3d3
SHA1a713b069ea66666daa4ee9bbff397b0c5ff85abf
SHA256d7156b868dedefbdb54325f2684c49caad031838b4af01f544712bbd77d21b80
SHA512544600a0f639e4ed0c3d31c1365ffa55efe51a3a909472c463b4cd145ba9379da5871c87470f6a3987f2bf732245a423736f9512dd5f7ff7357132fe077ffe9b
-
Filesize
306KB
MD5cc70ed7eae59662c82d6a6114a1c0038
SHA138a031abc09afc6e924243e11a7245cc809dd037
SHA2560abba40eaf487c4f3bba0446fb249647b7dee71105f2d75fc7c7257b9687b9c2
SHA512dbfb702f46334ac42edbb8eaa91a9b428b31b6fd7f18b1cc0f4e535266df72a254ebd13da5bee797f2a0155aad951bd44e1f048e5d1bd75a57c6daab9b11ccee