Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 14:04
Static task
static1
Behavioral task
behavioral1
Sample
46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe
Resource
win10v2004-20241007-en
General
-
Target
46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe
-
Size
478KB
-
MD5
9d2b7de66ce75deae7849c1464d3474a
-
SHA1
7c59929567d7dcb68132be779f02236f6b950eb4
-
SHA256
46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e
-
SHA512
b5c445e742df79a34a1888ba4a88154c0ef83e9d99f11fc070bcadf999d5e6dd6d60ced8777fff81636391b856c313854c432420b0a5e718b65471eee027b7e9
-
SSDEEP
6144:Kvy+bnr+Np0yN90QET4D4+nZFFyzUsn+vxAvI85tM9BiIaV65Pktu0mHMd4t:ZMr5y906c+ZjsnRQYtM5Fxkt5qMqt
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x000b000000023b7d-12.dat healer behavioral1/memory/4100-15-0x0000000000100000-0x000000000010A000-memory.dmp healer behavioral1/memory/4148-22-0x0000000002270000-0x000000000228A000-memory.dmp healer behavioral1/memory/4148-24-0x0000000004C70000-0x0000000004C88000-memory.dmp healer behavioral1/memory/4148-25-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-30-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-50-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-48-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-47-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-44-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-42-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-40-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-38-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-36-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-34-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-28-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-52-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-26-0x0000000004C70000-0x0000000004C82000-memory.dmp healer behavioral1/memory/4148-32-0x0000000004C70000-0x0000000004C82000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" eGd10EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" eGd10EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" eGd10EV.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection dWU60Gd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" eGd10EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dWU60Gd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dWU60Gd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dWU60Gd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection eGd10EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" eGd10EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dWU60Gd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dWU60Gd.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023b7a-57.dat family_redline behavioral1/memory/452-59-0x0000000000D70000-0x0000000000DA2000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 3496 nqY49ui36.exe 4100 dWU60Gd.exe 4148 eGd10EV.exe 452 fxE98pE.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dWU60Gd.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features eGd10EV.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" eGd10EV.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nqY49ui36.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2680 sc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1344 4148 WerFault.exe 96 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nqY49ui36.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eGd10EV.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxE98pE.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4100 dWU60Gd.exe 4100 dWU60Gd.exe 4148 eGd10EV.exe 4148 eGd10EV.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4100 dWU60Gd.exe Token: SeDebugPrivilege 4148 eGd10EV.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3252 wrote to memory of 3496 3252 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe 83 PID 3252 wrote to memory of 3496 3252 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe 83 PID 3252 wrote to memory of 3496 3252 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe 83 PID 3496 wrote to memory of 4100 3496 nqY49ui36.exe 84 PID 3496 wrote to memory of 4100 3496 nqY49ui36.exe 84 PID 3496 wrote to memory of 4148 3496 nqY49ui36.exe 96 PID 3496 wrote to memory of 4148 3496 nqY49ui36.exe 96 PID 3496 wrote to memory of 4148 3496 nqY49ui36.exe 96 PID 3252 wrote to memory of 452 3252 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe 101 PID 3252 wrote to memory of 452 3252 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe 101 PID 3252 wrote to memory of 452 3252 46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe"C:\Users\Admin\AppData\Local\Temp\46892459ba739c80a35de6e22cf3e288e8b80988b8413888cec8d439451c8c4e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqY49ui36.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nqY49ui36.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWU60Gd.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dWU60Gd.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eGd10EV.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eGd10EV.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4148 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 10804⤵
- Program crash
PID:1344
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fxE98pE.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fxE98pE.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4148 -ip 41481⤵PID:1780
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:2680
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
334KB
MD50b0490e2709c054078774a88548658d5
SHA1ab0a26315601261caf3658cdb5ed7e5f282ca812
SHA2566f12c2512fd358ed5c7c96bcf97f8b60bf336a0daa0c13cd3122e3ebe843a104
SHA512a8a316e4416016c67c50ffe3886ca663a0e98d37b5f9d986da6af77a86f0e29b3f5d61c4dbbabe583dcb6956144fd608c7f382bbf8aee1b9bcc0e37334ea4d15
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
241KB
MD5f2bcb17a128cbfa928ca290d240f9601
SHA1487e8bd83d6aa5a8633562ff09254ae922f158f6
SHA256986bc0236c044a0f4a4e94f3232e1d7d34ce488c289639e059456fb80184b2e6
SHA5124ee4abb1b4c7d4c23e9e40d9ab857b72fbf36f5688bcbb5a4b674620843a0f3f5fed178405f2ac587f9e2a56c91cb1b0d584ff876c5e5639f91fb42b76b1e923