Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2024, 00:55
Static task
static1
Behavioral task
behavioral1
Sample
873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe
Resource
win10v2004-20241007-en
General
-
Target
873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe
-
Size
1.0MB
-
MD5
fa8eb93edd1a593d1fee14776104c7da
-
SHA1
17878f35d9711aca307c0a9f90d3a6559f19f3f7
-
SHA256
873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b
-
SHA512
27852cb3c89d1fc309eb256df8dfbb5a060cdc5664f9bd05c97ac159ced031b6793d2b8d58223a51e644518534a5b71de274f5a3e54b09e720f949817f24c9c3
-
SSDEEP
24576:Myu0SaCfLF6KOWWaYleBDoIp8mGzB58PI7MmoW:74aYLgKOJ6DzqmGz8womo
Malware Config
Extracted
redline
norm
77.91.124.145:4125
-
auth_value
1514e6c0ec3d10a36f68f61b206f5759
Extracted
redline
droz
77.91.124.145:4125
-
auth_value
d099adf6dbf6ccb8e16967104280634a
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/1744-25-0x00000000025F0000-0x000000000260A000-memory.dmp healer behavioral1/memory/1744-27-0x0000000005140000-0x0000000005158000-memory.dmp healer behavioral1/memory/1744-55-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-53-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-51-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-49-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-47-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-45-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-43-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-41-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-39-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-37-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-35-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-33-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-31-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-29-0x0000000005140000-0x0000000005152000-memory.dmp healer behavioral1/memory/1744-28-0x0000000005140000-0x0000000005152000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr777185.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr777185.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr777185.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr777185.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr777185.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr777185.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 5 IoCs
resource yara_rule behavioral1/memory/3380-2149-0x0000000005400000-0x0000000005432000-memory.dmp family_redline behavioral1/files/0x000800000001e4d5-2154.dat family_redline behavioral1/memory/608-2162-0x0000000000570000-0x00000000005A0000-memory.dmp family_redline behavioral1/files/0x0007000000023cb5-2170.dat family_redline behavioral1/memory/5936-2173-0x00000000005E0000-0x000000000060E000-memory.dmp family_redline -
Redline family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation qu290334.exe -
Executes dropped EXE 6 IoCs
pid Process 3512 un745848.exe 2288 un494887.exe 1744 pr777185.exe 3380 qu290334.exe 608 1.exe 5936 rk676385.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr777185.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr777185.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un745848.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un494887.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3996 1744 WerFault.exe 87 1820 3380 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un745848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language un494887.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pr777185.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language qu290334.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rk676385.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1744 pr777185.exe 1744 pr777185.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1744 pr777185.exe Token: SeDebugPrivilege 3380 qu290334.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4464 wrote to memory of 3512 4464 873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe 83 PID 4464 wrote to memory of 3512 4464 873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe 83 PID 4464 wrote to memory of 3512 4464 873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe 83 PID 3512 wrote to memory of 2288 3512 un745848.exe 84 PID 3512 wrote to memory of 2288 3512 un745848.exe 84 PID 3512 wrote to memory of 2288 3512 un745848.exe 84 PID 2288 wrote to memory of 1744 2288 un494887.exe 87 PID 2288 wrote to memory of 1744 2288 un494887.exe 87 PID 2288 wrote to memory of 1744 2288 un494887.exe 87 PID 2288 wrote to memory of 3380 2288 un494887.exe 96 PID 2288 wrote to memory of 3380 2288 un494887.exe 96 PID 2288 wrote to memory of 3380 2288 un494887.exe 96 PID 3380 wrote to memory of 608 3380 qu290334.exe 97 PID 3380 wrote to memory of 608 3380 qu290334.exe 97 PID 3380 wrote to memory of 608 3380 qu290334.exe 97 PID 3512 wrote to memory of 5936 3512 un745848.exe 100 PID 3512 wrote to memory of 5936 3512 un745848.exe 100 PID 3512 wrote to memory of 5936 3512 un745848.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe"C:\Users\Admin\AppData\Local\Temp\873e3732e1d6d1aa0572b5decd497408516e868e46af5cf9555bdeeec6bc986b.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un745848.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un745848.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un494887.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un494887.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr777185.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr777185.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 10805⤵
- Program crash
PID:3996
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu290334.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu290334.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3380 -s 15285⤵
- Program crash
PID:1820
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk676385.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk676385.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5936
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1744 -ip 17441⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3380 -ip 33801⤵PID:1976
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
801KB
MD5147ef6b57e361cedde6de753c6ed8027
SHA1466c79a63793162f864402dce9cc79d7ef6742a3
SHA256909735b294dfc6b7325046e2cd291b6de37390ee0dc8cb2d67af9b91dcc3bdf6
SHA5121b8d8f36706206baf8645b2c2f427b34d6bc290efe33cd7aa22c8dee72b1150ee120028c094a1a94b78d78f9c1c0b564fca20fb45056a7094306fde5000d200d
-
Filesize
168KB
MD5b08c27aae44c72d23d3f1e029c0c1e65
SHA1581f60b8faa4f09474b08ec3db5a532d793595ad
SHA25622bfb643570e4b793619afed93b230cc6f6259ece95fb57932c369fac5771ea2
SHA512afc0d9dceea711fdccd5a516c399a630b32323dd1e36481cf4bfb233fdf44a8e4f45d4fc5d29aded6b7ce0e9d0602abed290442f543d03ca249dcc9019c97172
-
Filesize
647KB
MD565af3fb69ea8fe7b7dab6a4848938708
SHA1ad5e51e8b5d7bd24ed1b2a4260c21430133bd7b1
SHA25672d580fb84c0bab45447cc15b213c92515d3f92144ba97302813c012d10710e8
SHA51294ccf439bc9347996cf4189c02519d3c28a35f9dc8c783c665b6b7d0960bba33786ac7257de3a0ca360d480e7ed8e65f9e0c8631253b171e35203c70590f1396
-
Filesize
243KB
MD533cca09bcf96b6a39bbd4a4558660196
SHA17a592f17e4ac2d3baf8fbe8fe1e67ac3b4b5ac0c
SHA256da3ab01175ba4e023eb1772f5df2b15e2d60f7e3b420b13a29b78df7a740aabb
SHA51279e00af4f4033a465b872bede5369b51b2e86538f0ba4357fbcf7b7b3f96d0ed3a0c359599c8554a29c5f5c9b8a52f930e42c8ad6f66dfc976fd7179c56fb19d
-
Filesize
426KB
MD58747d71c639e1601936a83fe9d0f9eff
SHA1d1b7161efa8be846b22818f214778e5e0f6ae18c
SHA256ac41236aa77241e049a9e1dff3846172a5548d9fc799be722f21f7eb7c8ef255
SHA5120e47e8986781c501b301b25ef6482572cb3fe8600c1a8f84c514fa1929669dbec1b9092e5101881e9e1fd65220f28aa6005d8d56163695746dc23cc1d273b36d
-
Filesize
168KB
MD51073b2e7f778788852d3f7bb79929882
SHA17f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4
SHA256c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb
SHA51290cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0