Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 10:33
Static task
static1
Behavioral task
behavioral1
Sample
f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe
Resource
win10v2004-20241007-en
General
-
Target
f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe
-
Size
471KB
-
MD5
d8365d6675b4e456cb5323f9dbb7b8bf
-
SHA1
fac596d8267c3ef2902904824f6bcc7a2cdde4bf
-
SHA256
f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4
-
SHA512
9f9a4bc792d12fd9a7c79bea21db01622e9c63d62202e3225e26693f2c4eb9667afeeff26eed80c05703945fee367e5c41cd9d30949324a31f9484014000ef35
-
SSDEEP
12288:nMr/y908ubz/UkQ9HrlD9AL1ITzJDp4WF:AyFubbPQVlRC2Tth
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4404-19-0x0000000002540000-0x000000000255A000-memory.dmp healer behavioral1/memory/4404-21-0x00000000027E0000-0x00000000027F8000-memory.dmp healer behavioral1/memory/4404-22-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-25-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-23-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-27-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-49-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-47-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-45-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-43-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-41-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-40-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-37-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-35-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-33-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-32-0x00000000027E0000-0x00000000027F2000-memory.dmp healer behavioral1/memory/4404-29-0x00000000027E0000-0x00000000027F2000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bVa24qQ.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bVa24qQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bVa24qQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bVa24qQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bVa24qQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bVa24qQ.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023bae-57.dat family_redline behavioral1/memory/4172-59-0x0000000000F80000-0x0000000000FB2000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2528 nRC87Cp.exe 4404 bVa24qQ.exe 4172 dUW93Bl.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bVa24qQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bVa24qQ.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nRC87Cp.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2788 4404 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nRC87Cp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bVa24qQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dUW93Bl.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4404 bVa24qQ.exe 4404 bVa24qQ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4404 bVa24qQ.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2528 1244 f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe 83 PID 1244 wrote to memory of 2528 1244 f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe 83 PID 1244 wrote to memory of 2528 1244 f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe 83 PID 2528 wrote to memory of 4404 2528 nRC87Cp.exe 84 PID 2528 wrote to memory of 4404 2528 nRC87Cp.exe 84 PID 2528 wrote to memory of 4404 2528 nRC87Cp.exe 84 PID 2528 wrote to memory of 4172 2528 nRC87Cp.exe 99 PID 2528 wrote to memory of 4172 2528 nRC87Cp.exe 99 PID 2528 wrote to memory of 4172 2528 nRC87Cp.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe"C:\Users\Admin\AppData\Local\Temp\f2e9fa09874da56ce9de0df3fed44679b8ca1251f6a5bffa9165a3a4843794a4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nRC87Cp.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nRC87Cp.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bVa24qQ.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bVa24qQ.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 11044⤵
- Program crash
PID:2788
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUW93Bl.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUW93Bl.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4172
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4404 -ip 44041⤵PID:680
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
367KB
MD522f5e21cf1006cb4c80b03b56544e57d
SHA11e38fb02276d8a70b958377ead92adce8dda4ba1
SHA256343a7dafdb0af22772ffbbcb5b64d0cb9e199be1d3b3b5bfc4e698e00ddc6a06
SHA512a47faa1e5bcdd7fa1dc224162a9180404aa3e3e6f2d7bb8a3f909a0fa33d3426598ea35293a04364531e7232b4b64fee0a112c48a76e33395b64bfde29616bd0
-
Filesize
221KB
MD54feb45b0494ebda3a75baf46d9a6ace6
SHA1412a2e08c2def6996742c6e8fc20cfc982d30cd9
SHA2563e361b1e9b10cdc0c9f294148c6f4b4bc0d93a4562a6b8dda641e870e1432f77
SHA512d408c826beba95df794cd648f8ccb87d871c35368038bea9105c550b5b5f054241c75d73d46056a313aa045ff02a5322bac2e754d542bd7d469f9bd69cc87125
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2