Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 20:33
Static task
static1
Behavioral task
behavioral1
Sample
3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe
Resource
win10v2004-20241007-en
General
-
Target
3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe
-
Size
478KB
-
MD5
dffdba4675d452de23143a8257921279
-
SHA1
f9da0ed1455bc0346ffb22b3b80911f6621b59c0
-
SHA256
3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58
-
SHA512
6efaef1b4dae19e6ac608f7234d015a27dbbebc56dec6b79e17392812090bb8234b099869269097447d7b28675d2b2dfdf81194c75d9048566522a4436c854e6
-
SSDEEP
6144:Kvy+bnr+Dp0yN90QEDeQUdG4hIOr4+LJM9qAEkKceoKCutx+9dadTSNANFTj:xMrby908/G2HLMqKKcKztQ9daEiTTj
Malware Config
Extracted
redline
fukia
193.233.20.13:4136
-
auth_value
e5783636fbd9e4f0cf9a017bce02e67e
Signatures
-
Detects Healer an antivirus disabler dropper 17 IoCs
resource yara_rule behavioral1/memory/4412-19-0x0000000002810000-0x000000000282A000-memory.dmp healer behavioral1/memory/4412-21-0x0000000004CF0000-0x0000000004D08000-memory.dmp healer behavioral1/memory/4412-49-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-47-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-45-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-43-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-41-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-39-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-37-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-35-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-33-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-31-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-29-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-27-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-25-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-23-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer behavioral1/memory/4412-22-0x0000000004CF0000-0x0000000004D02000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection bJN55xi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" bJN55xi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" bJN55xi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" bJN55xi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" bJN55xi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" bJN55xi.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x000a000000023b99-58.dat family_redline behavioral1/memory/2440-60-0x0000000000DE0000-0x0000000000E12000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2452 nBa59Cu.exe 4412 bJN55xi.exe 2440 dsE71JT.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bJN55xi.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bJN55xi.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" nBa59Cu.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2016 4412 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nBa59Cu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bJN55xi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dsE71JT.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4412 bJN55xi.exe 4412 bJN55xi.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4412 bJN55xi.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3752 wrote to memory of 2452 3752 3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe 83 PID 3752 wrote to memory of 2452 3752 3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe 83 PID 3752 wrote to memory of 2452 3752 3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe 83 PID 2452 wrote to memory of 4412 2452 nBa59Cu.exe 84 PID 2452 wrote to memory of 4412 2452 nBa59Cu.exe 84 PID 2452 wrote to memory of 4412 2452 nBa59Cu.exe 84 PID 2452 wrote to memory of 2440 2452 nBa59Cu.exe 99 PID 2452 wrote to memory of 2440 2452 nBa59Cu.exe 99 PID 2452 wrote to memory of 2440 2452 nBa59Cu.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe"C:\Users\Admin\AppData\Local\Temp\3def8a6f4b025bbc8a6392520c3c020150cd57582dadf17635fa63a550e4be58.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nBa59Cu.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nBa59Cu.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bJN55xi.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\bJN55xi.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4412 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 10364⤵
- Program crash
PID:2016
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsE71JT.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dsE71JT.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2440
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4412 -ip 44121⤵PID:4384
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
374KB
MD5eae956db01bea4a88163a11bcf7cadb0
SHA1376b402a44beeaa82477c1f236e845bfee37857a
SHA2569172039b9bc523742af7488b57c1ec9750a3ba0ceb683b19461053c0ebc128ad
SHA51270a4492e97f17f710edeb934c4f8f646adf29d54ab5000752fb4c7fe3d68a04d8a0c7a33cc9d90fa883f2ad383a954c2a428e79ee547c172efdd6cf5e7b23fdb
-
Filesize
235KB
MD55179ecce0539ae27dc4f03489b9590c3
SHA18476515cacf77c049d203f856adac1fff4a13484
SHA256cbbafaa829b55617ec28b25560ab8c12bcdd05ae1d021fcad3102763d7dd6799
SHA512e2fe7c24367e123c38e0de7327157b78a8d43c743ce5a2bcb20e817d1ed8ba1dd9c2f37e50296805b834cd931911d5192fcc53c0672ea66a18a9686dbac5bcb4
-
Filesize
175KB
MD5a5f5c5d6291c7ae9e1d1b7ed1e551490
SHA13d06413341893b838549939e15f8f1eec423d71a
SHA2561a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e
SHA512d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2