Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe
Resource
win10v2004-20241007-en
General
-
Target
aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe
-
Size
478KB
-
MD5
e68cb405dfb2ac2319bec791c676a008
-
SHA1
949f83260b06133366d6263056cccc78485697ea
-
SHA256
aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7
-
SHA512
ab683f01bcb1fea09444afb7f0c7f9dd20b55d8c9c1418bfe716024f97e49351a33c198c76513ab6d1a419adf95ad32aa1b45b7c1e939d91a1ae75c4a101e009
-
SSDEEP
12288:/Mr3y90K1tPg4KUdJJJBrfyGUq27RQq4Zp0b8:syRbI4KUPRqGUq2N8v
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/2964-19-0x00000000027F0000-0x000000000280A000-memory.dmp healer behavioral1/memory/2964-21-0x0000000002AF0000-0x0000000002B08000-memory.dmp healer behavioral1/memory/2964-48-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-45-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-43-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-41-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-39-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-35-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-33-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-31-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-29-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-49-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-27-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-25-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-22-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-37-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer behavioral1/memory/2964-23-0x0000000002AF0000-0x0000000002B02000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bhJ02EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bhJ02EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bhJ02EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bhJ02EV.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bhJ02EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bhJ02EV.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023c31-58.dat family_redline behavioral1/memory/4712-60-0x0000000000220000-0x0000000000252000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1176 nxC64fN.exe 2964 bhJ02EV.exe 4712 dYH72nS.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bhJ02EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bhJ02EV.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nxC64fN.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 956 2964 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxC64fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhJ02EV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dYH72nS.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2964 bhJ02EV.exe 2964 bhJ02EV.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2964 bhJ02EV.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4836 wrote to memory of 1176 4836 aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe 83 PID 4836 wrote to memory of 1176 4836 aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe 83 PID 4836 wrote to memory of 1176 4836 aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe 83 PID 1176 wrote to memory of 2964 1176 nxC64fN.exe 84 PID 1176 wrote to memory of 2964 1176 nxC64fN.exe 84 PID 1176 wrote to memory of 2964 1176 nxC64fN.exe 84 PID 1176 wrote to memory of 4712 1176 nxC64fN.exe 99 PID 1176 wrote to memory of 4712 1176 nxC64fN.exe 99 PID 1176 wrote to memory of 4712 1176 nxC64fN.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe"C:\Users\Admin\AppData\Local\Temp\aeded8d176aea6a89efdab3a97df131e6ab95e440f5b9150e8de33ffc26441f7.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nxC64fN.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nxC64fN.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bhJ02EV.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bhJ02EV.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 10804⤵
- Program crash
PID:956
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dYH72nS.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dYH72nS.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4712
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2964 -ip 29641⤵PID:4412
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
374KB
MD500df45e32023f745df7cfe8c08ae33c9
SHA14a779abcc8063ba53cf53ec1369e274a5a9f2b10
SHA256386138c010bb54700d1041d79fff1b7a15983269e970e34370f3a29b785de1d8
SHA512630ed3eed0f17dccd32def676d1db3616d6d77cc9ac1d231e9f556f313f837ab5c5566ce2db5b6704d00c4c929be90c0e809289490049837a104e661aeb0bad8
-
Filesize
234KB
MD5a7585267b7ee449583a37516dd0875f3
SHA15e1d49da2036caac2bc7f8148196a85279cfcd88
SHA2565486cca58e0179df33a9eb3ab056acd4ff2c2c80ab610b7151215c8595c37a30
SHA51220f4503b80fdc94499e9895dbe63e497f11098b785b7f504dc53c451a4df72555aa04e0ae02c2d11efe56c370f04325ba78d07df72bda4bdd7dc3007196a79c6
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2