Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:17

General

  • Target

    ed75d761135df1f00119df867a5558c582eafbd9078023e581691ecbd940cd4b.exe

  • Size

    549KB

  • MD5

    e0483418ab2793e61ef36c4f009abb45

  • SHA1

    dffc0b54ea1bef41728694fb3404ed2549942d3b

  • SHA256

    ed75d761135df1f00119df867a5558c582eafbd9078023e581691ecbd940cd4b

  • SHA512

    99cd12795c1d6dc5792e7cfeb4e9fae651b28443d67976ee1fbcd26fa5317bd15af3c9fca0eb4160bb2169a72ff334a588a01c858d4ed3fa9b939914272b6c7b

  • SSDEEP

    12288:OMrCy90Vq9No+qm9p6UHofGf16yxwNjEMpXu8Xl1ipHRPFnS8F:YySwNo+v9UUHofK1HIjZuqKdS8F

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ed75d761135df1f00119df867a5558c582eafbd9078023e581691ecbd940cd4b.exe
    "C:\Users\Admin\AppData\Local\Temp\ed75d761135df1f00119df867a5558c582eafbd9078023e581691ecbd940cd4b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4704
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieq7821.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieq7821.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5096
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr367891.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr367891.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:8
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku309784.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku309784.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zieq7821.exe

    Filesize

    395KB

    MD5

    db3427709d0b73d7e174850fd3ca72dd

    SHA1

    91a234f800b67a8d9c6e484bd519888955223416

    SHA256

    82e09a27bbd9ec402d75ab22feab8e0bfcc4716d5f43516c629fc9e94a7e99f0

    SHA512

    8276e7420cb72a17e9f64d7107bd3ace9589647afcbfcb728d45c8d3f24e8d2d45a18a3a6b45bd761a382111898b9350f44ce17e4fe273b88fffebe07bc91bee

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr367891.exe

    Filesize

    11KB

    MD5

    71247cc60cb8b083a9985807bba1c33a

    SHA1

    988823f9ea54294a9dc3735dacf75882a02ed9e3

    SHA256

    a050c022bbd324d0f215cd8994eb48e9f791ed69025fb9b11a17b33b005a9846

    SHA512

    1f0a96893206bf5a779c3bb5e97c93145ee5644815e0b7671f6e7a4e13fa1737ca4c8a88047cdecb319137a52d87bbe801fa52ce61f910e21cd969ef7cc85ce1

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku309784.exe

    Filesize

    348KB

    MD5

    98d468660eb1a5b71faba54739ce0425

    SHA1

    1454a070d59284ef9838a0e15b9eaf63134a311b

    SHA256

    c909166dca8bce6587ed9c9ce20c6ac7df77ea2e8bb91eae45277270b2473357

    SHA512

    1106be72d32346faff32ad8acce8e330fc2ad2b435da1a6e721105d31aadbb8860b30b75a61af9c0dbf90029c75b6342c2c8ba4bf7ef014b5425ec684a3f8e4e

  • memory/8-14-0x00007FFE63BE3000-0x00007FFE63BE5000-memory.dmp

    Filesize

    8KB

  • memory/8-15-0x0000000000760000-0x000000000076A000-memory.dmp

    Filesize

    40KB

  • memory/8-16-0x00007FFE63BE3000-0x00007FFE63BE5000-memory.dmp

    Filesize

    8KB

  • memory/916-62-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-52-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-24-0x0000000005460000-0x00000000054A4000-memory.dmp

    Filesize

    272KB

  • memory/916-25-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-40-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-88-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-84-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-82-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-80-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-79-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-76-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-74-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-70-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-69-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-66-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-64-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-22-0x00000000027E0000-0x0000000002826000-memory.dmp

    Filesize

    280KB

  • memory/916-60-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-58-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-56-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-54-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-23-0x0000000004E70000-0x0000000005414000-memory.dmp

    Filesize

    5.6MB

  • memory/916-50-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-48-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-46-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-44-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-42-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-38-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-36-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-34-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-32-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-30-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-28-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-26-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-86-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-72-0x0000000005460000-0x000000000549F000-memory.dmp

    Filesize

    252KB

  • memory/916-931-0x00000000054A0000-0x0000000005AB8000-memory.dmp

    Filesize

    6.1MB

  • memory/916-932-0x0000000005B00000-0x0000000005C0A000-memory.dmp

    Filesize

    1.0MB

  • memory/916-933-0x0000000005C20000-0x0000000005C32000-memory.dmp

    Filesize

    72KB

  • memory/916-934-0x0000000005C40000-0x0000000005C7C000-memory.dmp

    Filesize

    240KB

  • memory/916-935-0x0000000005D90000-0x0000000005DDC000-memory.dmp

    Filesize

    304KB