Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 11:01
Static task
static1
Behavioral task
behavioral1
Sample
e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe
Resource
win10v2004-20241007-en
General
-
Target
e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe
-
Size
482KB
-
MD5
927025f72b402dd670095082a657e668
-
SHA1
d4b2b3719b1761be2ffaaf4c478d5033352a3f2e
-
SHA256
e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1
-
SHA512
ff9527be7ec3817c906f3db1fef28e46316131e5d3db82b7cdb92e73bd88fb5908719c5299dc38246540ce22a60f9436ff35351e989c84b738608322e7036ba8
-
SSDEEP
12288:AMrTy90Y4SsIQ52cwwE9MtKyEI/UwTruKTTQ/:Dy14rIfHpM1XUmuKTU/
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x000b000000023b74-12.dat healer behavioral1/memory/3000-15-0x0000000000870000-0x000000000087A000-memory.dmp healer behavioral1/memory/4920-22-0x0000000002250000-0x000000000226A000-memory.dmp healer behavioral1/memory/4920-24-0x0000000002440000-0x0000000002458000-memory.dmp healer behavioral1/memory/4920-48-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-52-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-50-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-46-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-44-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-42-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-41-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-38-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-36-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-34-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-30-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-28-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-26-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-25-0x0000000002440000-0x0000000002452000-memory.dmp healer behavioral1/memory/4920-32-0x0000000002440000-0x0000000002452000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection dyY29Bw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" dyY29Bw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" dyY29Bw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dyY29Bw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" dyY29Bw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" eBt29SS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" eBt29SS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" dyY29Bw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection eBt29SS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" eBt29SS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" eBt29SS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" eBt29SS.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023b72-56.dat family_redline behavioral1/memory/4344-59-0x0000000000FD0000-0x0000000001002000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 4 IoCs
pid Process 4656 nvh44CP35.exe 3000 dyY29Bw.exe 4920 eBt29SS.exe 4344 fxz24Nt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dyY29Bw.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features eBt29SS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" eBt29SS.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nvh44CP35.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4148 4920 WerFault.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvh44CP35.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eBt29SS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxz24Nt.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3000 dyY29Bw.exe 3000 dyY29Bw.exe 4920 eBt29SS.exe 4920 eBt29SS.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3000 dyY29Bw.exe Token: SeDebugPrivilege 4920 eBt29SS.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2416 wrote to memory of 4656 2416 e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe 83 PID 2416 wrote to memory of 4656 2416 e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe 83 PID 2416 wrote to memory of 4656 2416 e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe 83 PID 4656 wrote to memory of 3000 4656 nvh44CP35.exe 84 PID 4656 wrote to memory of 3000 4656 nvh44CP35.exe 84 PID 4656 wrote to memory of 4920 4656 nvh44CP35.exe 98 PID 4656 wrote to memory of 4920 4656 nvh44CP35.exe 98 PID 4656 wrote to memory of 4920 4656 nvh44CP35.exe 98 PID 2416 wrote to memory of 4344 2416 e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe 109 PID 2416 wrote to memory of 4344 2416 e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe 109 PID 2416 wrote to memory of 4344 2416 e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe"C:\Users\Admin\AppData\Local\Temp\e0529209995efbd170c29d5bda23f35ef83d724f814a15df14bd5a7a0cbad2d1.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nvh44CP35.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nvh44CP35.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dyY29Bw.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dyY29Bw.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eBt29SS.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eBt29SS.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4920 -s 10564⤵
- Program crash
PID:4148
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fxz24Nt.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fxz24Nt.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4344
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4920 -ip 49201⤵PID:4388
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2
-
Filesize
338KB
MD508b4e37ac2c6ae00e9b5efd274a8280d
SHA1f45747a6a76b67c50f1fed70bac8af10451293a2
SHA256bd8405a337de3d046e3fc05e0ea4e347f331566171cf11284a78f62ad48fb464
SHA512d27ecde898c25cd55b1d5cb6a9cceea076e16c4b2d8b6da039eca9726e44a54ee540524faafada7be299bd2dabfaec2e290cb74341d7c11b95f1861b5e4ba7bc
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
256KB
MD52fd2e600c3adef9ca6d4ce6f66832d6a
SHA17d4af01ea9f943f58df01f44fae5c3e9974129cf
SHA2566561aed20765201eabfb0ee00cc1eb0af0fa62a009143e6a9f701348a5526dcf
SHA5129c99902c776a5e3fadf9786844bbaeb21bcba5d337d525e4ace920214897f61c26fb9afa41c9f158ede276d05b6132b158038d0489d2124337585de44d9f4056