Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe
Resource
win10v2004-20241007-en
General
-
Target
cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe
-
Size
549KB
-
MD5
2a04709edd1d1f12fd1518b24b384c76
-
SHA1
95432e860bd9bcb1aec7d6ba66d6e6ace2eb4981
-
SHA256
cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d
-
SHA512
aa133da4275e2bced62aa91c6408afd4f047ab3f73932c7ec4636dd5f3eb2ca689d31bd2317810c606937234c922a5df3bc7ab319875cd5c69c7caf8b703913b
-
SSDEEP
12288:VMrSy90ST5gH482KZMIyVaopGGpJuDKgBnaQDU9SrUJbKvN:3yl58ZBmaopzujoQDU9J2l
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x0008000000023cc0-12.dat healer behavioral1/memory/4816-15-0x0000000000650000-0x000000000065A000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" jr369698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" jr369698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" jr369698.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection jr369698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" jr369698.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" jr369698.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/4004-22-0x00000000028A0000-0x00000000028E6000-memory.dmp family_redline behavioral1/memory/4004-24-0x0000000004DE0000-0x0000000004E24000-memory.dmp family_redline behavioral1/memory/4004-26-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-54-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-88-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-84-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-82-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-80-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-78-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-76-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-74-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-72-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-70-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-68-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-66-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-64-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-62-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-60-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-58-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-56-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-52-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-50-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-48-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-46-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-44-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-42-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-40-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-38-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-36-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-34-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-32-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-30-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-28-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-86-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline behavioral1/memory/4004-25-0x0000000004DE0000-0x0000000004E1F000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 3296 ziDN7925.exe 4816 jr369698.exe 4004 ku705618.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" jr369698.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" ziDN7925.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5536 sc.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ziDN7925.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ku705618.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4816 jr369698.exe 4816 jr369698.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4816 jr369698.exe Token: SeDebugPrivilege 4004 ku705618.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4548 wrote to memory of 3296 4548 cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe 83 PID 4548 wrote to memory of 3296 4548 cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe 83 PID 4548 wrote to memory of 3296 4548 cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe 83 PID 3296 wrote to memory of 4816 3296 ziDN7925.exe 84 PID 3296 wrote to memory of 4816 3296 ziDN7925.exe 84 PID 3296 wrote to memory of 4004 3296 ziDN7925.exe 95 PID 3296 wrote to memory of 4004 3296 ziDN7925.exe 95 PID 3296 wrote to memory of 4004 3296 ziDN7925.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe"C:\Users\Admin\AppData\Local\Temp\cb1ad377f0526296e0bd38400b53658cc8bab42868b99b68d75d24420a354f1d.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDN7925.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDN7925.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr369698.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr369698.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku705618.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku705618.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:5536
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD5d0740e1111e55d33774593555edad794
SHA1f5a89d4f9ed2ceb81be8612dba9d5c06535a4499
SHA256e07d88ecfbb788812b18231c2d3e557c16fd717a4ccb3dd8fd57713ec462cc94
SHA5126a61883bd6ec11a96e5ef314ff64aaf72c5e209609b00d33695b8775b38846e63fcbcfd4390ef2daa966dfaadfba49a1211ada351168089fc4e408ed5490a65a
-
Filesize
11KB
MD5b640637229907e7e1b3daea68a8b05d5
SHA1c053764acfb5b21e35d3617c9e2cba27089f79e4
SHA256749c2355bc23dde736406b00204448a96d4d1b2cfdd4ab19d10067b393f16dd2
SHA512b4f9e9659a195792eed0d6403bfa98f02d58c54742e5ae7329c2b9eefdf0cc10887733cd279765231be2a6fa8618616c925d21e021d609218838ccd02fe80367
-
Filesize
348KB
MD5294699772b2224e5e4849b68927d56a7
SHA13dd88e4bb300778b6d9a5ac66defbb2dce502c3f
SHA256e2c0faed15c6b2c96b71f59197294ecd72ea3ed18390d1c27c89a6be952cb2ee
SHA51285709cb13337831afde02c9a5e07f78ef2bc7714387dfb134e9cd6c0345f1ed19b5038a949889717b2346c20b7431d8cbba9399f1ee5b40350d2c50fd62c2814