Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/11/2024, 01:53 UTC

General

  • Target

    b181e8afd4822f75f69f62c09ee9194631a6669ca9283b575e855119316ba6c1.exe

  • Size

    927KB

  • MD5

    d671a43cc433dbff920e45965f5810f4

  • SHA1

    40180f91329335c841fd8d081e832e95af8ac826

  • SHA256

    b181e8afd4822f75f69f62c09ee9194631a6669ca9283b575e855119316ba6c1

  • SHA512

    41c8f2e1320435966201a0084b47b94cb9cf5b469c4a174aee0fa65f9a8708d427c27a3e9f2012be5071a87257e99f74624f113c2978e9855d1639bd5cdf1720

  • SSDEEP

    12288:RMrry90NAWuTHqbZRztu/KbFv1d+bWlUFoWK4IkpixJMPATx4cSSkxu3+uORf/bz:Gya8SWeFNd+6lUbK4IVVASYymbuy

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

droz

C2

77.91.124.145:4125

Attributes
  • auth_value

    d099adf6dbf6ccb8e16967104280634a

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b181e8afd4822f75f69f62c09ee9194631a6669ca9283b575e855119316ba6c1.exe
    "C:\Users\Admin\AppData\Local\Temp\b181e8afd4822f75f69f62c09ee9194631a6669ca9283b575e855119316ba6c1.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:372
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQa9310.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQa9310.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4876
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIF7287.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIF7287.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:212
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513356.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513356.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2124
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr316860.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr316860.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1448
          • C:\Windows\Temp\1.exe
            "C:\Windows\Temp\1.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:6092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 1552
            5⤵
            • Program crash
            PID:1828
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp153550.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp153550.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:944
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1448 -ip 1448
    1⤵
      PID:636

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      67.209.201.84.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      67.209.201.84.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      kp153550.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      kp153550.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      kp153550.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      kp153550.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      260 B
      5
    • 77.91.124.145:4125
      kp153550.exe
      260 B
      5
    • 77.91.124.145:4125
      1.exe
      156 B
      3
    • 77.91.124.145:4125
      kp153550.exe
      156 B
      3
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      73.159.190.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      73.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      71 B
      145 B
      1
      1

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      67.209.201.84.in-addr.arpa
      dns
      72 B
      132 B
      1
      1

      DNS Request

      67.209.201.84.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziQa9310.exe

      Filesize

      661KB

      MD5

      c42d3306b6f41279d7c7ea452f1d5d58

      SHA1

      7bce7ddf63b7a31e4d458e3197cfcb29c4137f6c

      SHA256

      49cdf73501b36dec57ea6cc731d80292b62a2f33818389707f5130f9060d5eee

      SHA512

      17ee69bbadcb40204aa4569d489aa67f3690501d9f7eb3d440320299ff1b91f74e39b3e113f95dea3a7cc5662e6931454c9a50061c81ac1a08b9a0e383bed9dc

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp153550.exe

      Filesize

      168KB

      MD5

      01e8b748de3920959cb99cabc270603e

      SHA1

      7a8088974d277b900de2a8738df8d0cb83970693

      SHA256

      4b0d0a419688cb34a825c63b933bfd37e145c2e65d88ff2d1631b61944aa1c90

      SHA512

      984d56d9d3a48901d8d42c7028a5ec9ab9f556822152dcff33e873ad452ff26be8ddaca2e2f2cf3052e116275ebccd44f1fb59ce56cdc197ffa01bc60c3999ea

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziIF7287.exe

      Filesize

      507KB

      MD5

      22d144ceb15971d704e373d1f7090d16

      SHA1

      005ff1875257790241902fecba9b84d4ccb93adb

      SHA256

      58462ddb5271718aa4b62480324039be3b6ad43e299bad9afd55ba8d33c506e6

      SHA512

      97df513b53f389ffc49150e92522ec6b23efc76636ddbdb46e2edbdf6dd444226745890d5c920ba5f0264e3cf6eafc65149a30694d7e826ed774ca005eb4184a

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it513356.exe

      Filesize

      15KB

      MD5

      e2e6fe9a49351846b3dfa3874333f5d3

      SHA1

      fcfa1279252ef9ba19e382e178cc1b54a9b59531

      SHA256

      9c1b44bfee7356fac9984eb55a57795cbaf6af8c0c3e3c78f8a54d912dbf3637

      SHA512

      6b493ecf1e967980ac2f4b816deb5a74e8c5a6ce99503944f8aaa93f1fdff669889a63645f812e0401adf2664bb9923745330e8bc03e19e37bc58c45727d2a01

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr316860.exe

      Filesize

      426KB

      MD5

      259de95abacce166bd7c584f3e2497a7

      SHA1

      7159ddb4e9f44adc2395d941d781dd26ba7cb8d0

      SHA256

      fa8f5a8a17d7fd1f0017229a2d6f241abd64b9ddba23641e638c028de35c8cb7

      SHA512

      14cb47991113a132f10e2c5f058e088816022f0a50a3e99ef3870d25ec5a13f2643ce7f8e8a06ef6cf8f0d4574c0c3f65c073ac3bc27801af37ee5d9b5d05f96

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      1073b2e7f778788852d3f7bb79929882

      SHA1

      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

      SHA256

      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

      SHA512

      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

    • memory/944-2137-0x0000000002E30000-0x0000000002E36000-memory.dmp

      Filesize

      24KB

    • memory/944-2136-0x0000000000AE0000-0x0000000000B0E000-memory.dmp

      Filesize

      184KB

    • memory/1448-61-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-49-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-45-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-95-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-93-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-89-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-87-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-85-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-83-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-81-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-79-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-77-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-75-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-71-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-69-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-67-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-65-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-63-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-31-0x0000000002590000-0x00000000025F6000-memory.dmp

      Filesize

      408KB

    • memory/1448-59-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-55-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-53-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-51-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-39-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-47-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-43-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-41-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-37-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-35-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-91-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-73-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-57-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-33-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-32-0x0000000002590000-0x00000000025EF000-memory.dmp

      Filesize

      380KB

    • memory/1448-2112-0x0000000005400000-0x0000000005432000-memory.dmp

      Filesize

      200KB

    • memory/1448-29-0x0000000004BF0000-0x0000000004C56000-memory.dmp

      Filesize

      408KB

    • memory/1448-30-0x0000000004C60000-0x0000000005204000-memory.dmp

      Filesize

      5.6MB

    • memory/2124-24-0x00007FFB5B5B3000-0x00007FFB5B5B5000-memory.dmp

      Filesize

      8KB

    • memory/2124-22-0x00000000001E0000-0x00000000001EA000-memory.dmp

      Filesize

      40KB

    • memory/2124-21-0x00007FFB5B5B3000-0x00007FFB5B5B5000-memory.dmp

      Filesize

      8KB

    • memory/6092-2125-0x0000000000230000-0x0000000000260000-memory.dmp

      Filesize

      192KB

    • memory/6092-2126-0x0000000004A50000-0x0000000004A56000-memory.dmp

      Filesize

      24KB

    • memory/6092-2127-0x0000000005270000-0x0000000005888000-memory.dmp

      Filesize

      6.1MB

    • memory/6092-2128-0x0000000004D60000-0x0000000004E6A000-memory.dmp

      Filesize

      1.0MB

    • memory/6092-2129-0x0000000004AA0000-0x0000000004AB2000-memory.dmp

      Filesize

      72KB

    • memory/6092-2130-0x0000000004B00000-0x0000000004B3C000-memory.dmp

      Filesize

      240KB

    • memory/6092-2131-0x0000000004C60000-0x0000000004CAC000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.