Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:19

General

  • Target

    054b539eaa23fb708c46765d22d4c68b290723aab607cda23107758addfa3e22.exe

  • Size

    650KB

  • MD5

    b774b345fa4c493fafe69ab23553af36

  • SHA1

    9c5cce40cc53601803868c3ab6d57b46b8cb7b78

  • SHA256

    054b539eaa23fb708c46765d22d4c68b290723aab607cda23107758addfa3e22

  • SHA512

    93e4cc2399a55b93fcc6d212e469874cccbeaef38fe33f2d1e721f12e4d8c2c1cc3d1fd0617c78ab206cd312a5bae7d4bd1aba972ba75ef6b0341e50d7d2a668

  • SSDEEP

    12288:0MrLy90g+KZkqMzMAhLeLu91KxbzZa3iUNSuNouivzy5VOe:HysqMIALeLu91Kxbda3iceuivzyGe

Malware Config

Extracted

Family

redline

Botnet

norm

C2

77.91.124.145:4125

Attributes
  • auth_value

    1514e6c0ec3d10a36f68f61b206f5759

Extracted

Family

redline

Botnet

diza

C2

77.91.124.145:4125

Attributes
  • auth_value

    bbab0d2f0ae4d4fdd6b17077d93b3e80

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 5 IoCs
  • Redline family
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\054b539eaa23fb708c46765d22d4c68b290723aab607cda23107758addfa3e22.exe
    "C:\Users\Admin\AppData\Local\Temp\054b539eaa23fb708c46765d22d4c68b290723aab607cda23107758addfa3e22.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCt1076.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCt1076.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4516
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr722613.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr722613.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku189241.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku189241.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Windows\Temp\1.exe
          "C:\Windows\Temp\1.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5928
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 1376
          4⤵
          • Program crash
          PID:6072
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr329239.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr329239.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4428
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2476 -ip 2476
    1⤵
      PID:6024
    • C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start wuauserv
      1⤵
      • Launches sc.exe
      PID:2060

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr329239.exe

      Filesize

      168KB

      MD5

      43f6268c18ce5501850147b049faffe9

      SHA1

      faa1868333a12520267a8c698e94b9283a0f470e

      SHA256

      f881227a4550edcb80c1ce02001164da3df9215ba2fd9109bfffbf9e66c1bc19

      SHA512

      2b875273daf722fcc93c6103fb3531801f2d122dc8e9a401412e25f6594db9c1081e3473295fb4ee4f9458b99aeafe00f844ee6e341a7a717e219568a3c9fb0c

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziCt1076.exe

      Filesize

      496KB

      MD5

      37c64e612daaba4ede9b51442d02510e

      SHA1

      dd79aaf199db5bbd846e40467bd32226a36220a4

      SHA256

      12ae90fc9d098d816f3e594d4e8a11834200f7096770a693d3df3e4face0675a

      SHA512

      4ca8a66d7fe9cfc8f5e3d3f1ea62302926525c65fb90d688baebcfdbbbf2da4aad40af2f77db59dbbc2141693ae3740b37dcc8dc987b9dbaa8294e3e19a51ff4

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr722613.exe

      Filesize

      11KB

      MD5

      47db0ec2b979ed9fc1927b783fffc4f0

      SHA1

      9d64fd262e84bf22e1f64790445c11975223275c

      SHA256

      64995464f1ccd062407079e0142fab4edb3ebbac15d111f5d41e6c7892f0283d

      SHA512

      11f302ac74fca7dba02ecc43b448608b46b8d0bef452d04f62494117b1b9aed85e3b17b765982c0317b1d59c144bb60120ed67023cfd6236bc6d625454a44b9a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku189241.exe

      Filesize

      414KB

      MD5

      97cb1de5f6d3beff57bd2fa7dcaf4881

      SHA1

      b3f0f7ce21ecabcf6fdaa5d6740bedac4b134362

      SHA256

      c6cad0f12260119c5709647fd0459efec1552bfbfbbd021e960465f9660f5762

      SHA512

      8033c69ce1db26a364e3ac9d5c75b74b50f227443bbb11d3ab527434ef9c44ccba2274de473ae553dc74240268ad9d4573f91f12f8f756937fbdb92ffdafe711

    • C:\Windows\Temp\1.exe

      Filesize

      168KB

      MD5

      1073b2e7f778788852d3f7bb79929882

      SHA1

      7f5ca4d69e0fcaf8fe6de2e80455a8b90eb6e2c4

      SHA256

      c46ef7b768c697e57d379ddfdfd3fb4931bf3d535730ef60feca9332e7a19feb

      SHA512

      90cacc509128f9dfb4d96ae9e847ed61b2062297f39d03f481fb1f798b45b36a2d3a8fe2e6415bdc8ce363cf21decee5a9e080f23270395712da1fea9f4952d0

    • memory/2476-52-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-56-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-24-0x0000000004C10000-0x0000000004C76000-memory.dmp

      Filesize

      408KB

    • memory/2476-36-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-40-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-88-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-86-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-84-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-82-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-80-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-78-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-74-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-72-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-70-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-68-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-66-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-64-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-62-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-58-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-44-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-54-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-22-0x0000000004BA0000-0x0000000004C06000-memory.dmp

      Filesize

      408KB

    • memory/2476-51-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-48-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-23-0x0000000004CA0000-0x0000000005244000-memory.dmp

      Filesize

      5.6MB

    • memory/2476-42-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-46-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-38-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-34-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-32-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-30-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-28-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-76-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-60-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-26-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-25-0x0000000004C10000-0x0000000004C6F000-memory.dmp

      Filesize

      380KB

    • memory/2476-2105-0x0000000005400000-0x0000000005432000-memory.dmp

      Filesize

      200KB

    • memory/4428-2130-0x00000000021E0000-0x00000000021E6000-memory.dmp

      Filesize

      24KB

    • memory/4428-2129-0x0000000000040000-0x000000000006E000-memory.dmp

      Filesize

      184KB

    • memory/4796-14-0x00007FF97BA13000-0x00007FF97BA15000-memory.dmp

      Filesize

      8KB

    • memory/4796-16-0x00007FF97BA13000-0x00007FF97BA15000-memory.dmp

      Filesize

      8KB

    • memory/4796-15-0x00000000009F0000-0x00000000009FA000-memory.dmp

      Filesize

      40KB

    • memory/5928-2118-0x0000000000E10000-0x0000000000E40000-memory.dmp

      Filesize

      192KB

    • memory/5928-2120-0x0000000005E70000-0x0000000006488000-memory.dmp

      Filesize

      6.1MB

    • memory/5928-2121-0x0000000005960000-0x0000000005A6A000-memory.dmp

      Filesize

      1.0MB

    • memory/5928-2122-0x0000000005690000-0x00000000056A2000-memory.dmp

      Filesize

      72KB

    • memory/5928-2123-0x00000000056F0000-0x000000000572C000-memory.dmp

      Filesize

      240KB

    • memory/5928-2119-0x0000000003140000-0x0000000003146000-memory.dmp

      Filesize

      24KB

    • memory/5928-2124-0x0000000005850000-0x000000000589C000-memory.dmp

      Filesize

      304KB