Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/11/2024, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe
Resource
win10v2004-20241007-en
General
-
Target
e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe
-
Size
471KB
-
MD5
e70a8d7d70c202e2e50a280cad837c08
-
SHA1
8940cb6c298e48749e7002a53134ef1f692b5c41
-
SHA256
e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6
-
SHA512
d2d03101c9437ba6c901aaf9f499df2087f54822b64642b9501879f405b846a47df41a9f4ef71446dc5ce8398c39f47307d74adb5c5e0fafeb9ac192920c7a86
-
SSDEEP
12288:1Mr3y90Bd7WVVb1xzxlD9ABXITz8DsoWs:yy4dyVVrzxlR44Tor
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/3124-19-0x00000000029A0000-0x00000000029BA000-memory.dmp healer behavioral1/memory/3124-21-0x0000000004E70000-0x0000000004E88000-memory.dmp healer behavioral1/memory/3124-49-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-31-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-29-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-47-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-45-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-43-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-41-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-39-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-37-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-35-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-33-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-27-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-25-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-23-0x0000000004E70000-0x0000000004E82000-memory.dmp healer behavioral1/memory/3124-22-0x0000000004E70000-0x0000000004E82000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bUR08xH.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bUR08xH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bUR08xH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bUR08xH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bUR08xH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bUR08xH.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023b94-58.dat family_redline behavioral1/memory/4716-60-0x0000000000880000-0x00000000008B2000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1700 nwx64LZ.exe 3124 bUR08xH.exe 4716 dbH84ZV.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bUR08xH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bUR08xH.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nwx64LZ.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4540 3124 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nwx64LZ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bUR08xH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbH84ZV.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3124 bUR08xH.exe 3124 bUR08xH.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3124 bUR08xH.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 448 wrote to memory of 1700 448 e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe 84 PID 448 wrote to memory of 1700 448 e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe 84 PID 448 wrote to memory of 1700 448 e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe 84 PID 1700 wrote to memory of 3124 1700 nwx64LZ.exe 85 PID 1700 wrote to memory of 3124 1700 nwx64LZ.exe 85 PID 1700 wrote to memory of 3124 1700 nwx64LZ.exe 85 PID 1700 wrote to memory of 4716 1700 nwx64LZ.exe 98 PID 1700 wrote to memory of 4716 1700 nwx64LZ.exe 98 PID 1700 wrote to memory of 4716 1700 nwx64LZ.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe"C:\Users\Admin\AppData\Local\Temp\e60b9fccfff8b61bed69cd6209b5a8e76ddf48e41f82dc28361090dff551abd6.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nwx64LZ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nwx64LZ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bUR08xH.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bUR08xH.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 10964⤵
- Program crash
PID:4540
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbH84ZV.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dbH84ZV.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4716
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3124 -ip 31241⤵PID:1832
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
367KB
MD5a233836b3ca2b1503f0d72a4f2752bcd
SHA1f14f86649c697c27b49fc229df62e78d97e789b0
SHA2560d9af717f6af05c6e3afad22360f900d2c8207bb8a7694307ab0e239add5bd9a
SHA5122227a27a8a084c255834726a0d1c6a65c81ec9ee69ccf7f853f7fb9e4b968fcdc6f21deb2e60761b4422e88faf789c17f4d24234624465cbf3f2265ebb415835
-
Filesize
221KB
MD54feb45b0494ebda3a75baf46d9a6ace6
SHA1412a2e08c2def6996742c6e8fc20cfc982d30cd9
SHA2563e361b1e9b10cdc0c9f294148c6f4b4bc0d93a4562a6b8dda641e870e1432f77
SHA512d408c826beba95df794cd648f8ccb87d871c35368038bea9105c550b5b5f054241c75d73d46056a313aa045ff02a5322bac2e754d542bd7d469f9bd69cc87125
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2