Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    126s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/11/2024, 09:46 UTC

General

  • Target

    ef140f9597637874696612d670072c3bf87857c1d160bb1e12a7f85dae8d3723.exe

  • Size

    500KB

  • MD5

    8b642c3708b8cc7e4cd6005762b17260

  • SHA1

    9cca95543b49a8b2d9005d1549f60e289d274ebb

  • SHA256

    ef140f9597637874696612d670072c3bf87857c1d160bb1e12a7f85dae8d3723

  • SHA512

    4b446551c547b371f488dcc1b568d292b4786c5831b357f12a38c361ea9f4cf392b06de27aa5b5938a9a4c1ba7cf9d95eb155865bfd0ef5eb9f682387f5c2641

  • SSDEEP

    12288:nMrTy90p+8/VseEi07qMhNKFDPoW/Ti1Cgr4Sk8Yn:0y1iVaPLcDAW/wl48Yn

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Signatures

  • Detects Healer an antivirus disabler dropper 19 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ef140f9597637874696612d670072c3bf87857c1d160bb1e12a7f85dae8d3723.exe
    "C:\Users\Admin\AppData\Local\Temp\ef140f9597637874696612d670072c3bf87857c1d160bb1e12a7f85dae8d3723.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ntx53VI90.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ntx53VI90.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4020
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dru52Pb.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dru52Pb.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2536
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\edF83fI.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\edF83fI.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1992
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 1084
          4⤵
          • Program crash
          PID:4884
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fft42xa.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fft42xa.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4564
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1992 -ip 1992
    1⤵
      PID:32

    Network

    • flag-us
      DNS
      209.205.72.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      209.205.72.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      83.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      83.210.23.2.in-addr.arpa
      IN PTR
      Response
      83.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-83deploystaticakamaitechnologiescom
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 193.233.20.13:4136
      fft42xa.exe
      260 B
      5
    • 193.233.20.13:4136
      fft42xa.exe
      260 B
      5
    • 193.233.20.13:4136
      fft42xa.exe
      260 B
      5
    • 193.233.20.13:4136
      fft42xa.exe
      260 B
      5
    • 193.233.20.13:4136
      fft42xa.exe
      260 B
      5
    • 8.8.8.8:53
      209.205.72.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      209.205.72.20.in-addr.arpa

    • 8.8.8.8:53
      83.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      83.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      73.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      73.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fft42xa.exe

      Filesize

      175KB

      MD5

      a5f5c5d6291c7ae9e1d1b7ed1e551490

      SHA1

      3d06413341893b838549939e15f8f1eec423d71a

      SHA256

      1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

      SHA512

      d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ntx53VI90.exe

      Filesize

      355KB

      MD5

      4275263d68fb6fb90862ef3a6d4aff24

      SHA1

      32dae5107110227930f44baba916480c5df12273

      SHA256

      50b27f55d9f3204e621d123e07cdd64f182814cf030a169bbd2f7cd4950b57f3

      SHA512

      d5e992ef8400d7c193220d0f019bc54858f2edcd58586b04eb6d81b75cc1d7241607d0b046573c6a8a8d488f53fbb77c41b9baac56f44de7679262044e8ee8ac

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dru52Pb.exe

      Filesize

      11KB

      MD5

      7e93bacbbc33e6652e147e7fe07572a0

      SHA1

      421a7167da01c8da4dc4d5234ca3dd84e319e762

      SHA256

      850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

      SHA512

      250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\edF83fI.exe

      Filesize

      295KB

      MD5

      dd0adf92524d842b17843e3a38769564

      SHA1

      4b34fbf5dade2193630f92053be9f0dcfe563d3c

      SHA256

      489cdd40de47bde8a31100897afafb3213c01de9cab0bc656e3cbf01c48e3682

      SHA512

      7fbb9c9ad3df3bfd0ae3741bf76c92bdd9ea3f23e1316f4948a60e1efc3ff6dcbd4d37d7da725659fa38a0cbc0fc41d1dc85515d56b15af5cbf891bfe6853bc2

    • memory/1992-44-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-38-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-22-0x00000000024C0000-0x00000000024DA000-memory.dmp

      Filesize

      104KB

    • memory/1992-23-0x0000000004CC0000-0x0000000005264000-memory.dmp

      Filesize

      5.6MB

    • memory/1992-24-0x00000000025D0000-0x00000000025E8000-memory.dmp

      Filesize

      96KB

    • memory/1992-26-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-28-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-34-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-52-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-50-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-48-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-47-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-55-0x0000000000400000-0x00000000005C6000-memory.dmp

      Filesize

      1.8MB

    • memory/1992-42-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-40-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-53-0x0000000000400000-0x00000000005C6000-memory.dmp

      Filesize

      1.8MB

    • memory/1992-37-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-32-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-30-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/1992-25-0x00000000025D0000-0x00000000025E2000-memory.dmp

      Filesize

      72KB

    • memory/2536-16-0x00007FF8DB203000-0x00007FF8DB205000-memory.dmp

      Filesize

      8KB

    • memory/2536-15-0x0000000000F70000-0x0000000000F7A000-memory.dmp

      Filesize

      40KB

    • memory/2536-14-0x00007FF8DB203000-0x00007FF8DB205000-memory.dmp

      Filesize

      8KB

    • memory/4564-59-0x0000000000020000-0x0000000000052000-memory.dmp

      Filesize

      200KB

    • memory/4564-60-0x0000000004E70000-0x0000000005488000-memory.dmp

      Filesize

      6.1MB

    • memory/4564-61-0x00000000049C0000-0x0000000004ACA000-memory.dmp

      Filesize

      1.0MB

    • memory/4564-62-0x00000000048F0000-0x0000000004902000-memory.dmp

      Filesize

      72KB

    • memory/4564-63-0x0000000004950000-0x000000000498C000-memory.dmp

      Filesize

      240KB

    • memory/4564-64-0x0000000004AD0000-0x0000000004B1C000-memory.dmp

      Filesize

      304KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.