Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2024, 01:28

General

  • Target

    86e6deec6b34dc722dc0caba7b1e6e0e3846bd5c37ba1537b83acd6ec2c2ce18.exe

  • Size

    529KB

  • MD5

    a479ee30c4dcab237fdaefafb1e5ed30

  • SHA1

    524729d1bcb702304f05f28850fe9476036485f2

  • SHA256

    86e6deec6b34dc722dc0caba7b1e6e0e3846bd5c37ba1537b83acd6ec2c2ce18

  • SHA512

    077794d53531dd9593c0f92d14ac1a0ee84ac34901f2f50bcbaf90f7f0378ab4fda4879876b2505043e909315143c0b735807fd793c87facb5e8364ddbaf798c

  • SSDEEP

    12288:sMrwy90GrpmVvb5eIq3S/GVsIHvfDcqq9:syXgVvleF3S/4XX5E

Malware Config

Extracted

Family

redline

Botnet

rulit

C2

pedigj.eu:4162

Attributes
  • auth_value

    f4df9ef56871d4ac883b282abaf635e0

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86e6deec6b34dc722dc0caba7b1e6e0e3846bd5c37ba1537b83acd6ec2c2ce18.exe
    "C:\Users\Admin\AppData\Local\Temp\86e6deec6b34dc722dc0caba7b1e6e0e3846bd5c37ba1537b83acd6ec2c2ce18.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhFM2400kX.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhFM2400kX.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4236
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf50KT17hW78.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf50KT17hW78.exe
        3⤵
        • Modifies Windows Defender Real-time Protection settings
        • Executes dropped EXE
        • Windows security modification
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:912
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf19Vy96sL31.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf19Vy96sL31.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:2624

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhFM2400kX.exe

    Filesize

    385KB

    MD5

    8a8c91a584628b218b8e4d40b7025458

    SHA1

    898b91335c6a2bc6d80e4f3b3e6158a12c21b5b4

    SHA256

    10a550e593c2faf59f9d70b7c3c0f06c406d924d14dfa83862809ccb7136717e

    SHA512

    2e0e7178926e03841347d918ef31d7372e0fe05dc93ce9cedaff751b090e89f453524af02b74b442c469168499fa286778347ce3d68222a99c9c75c704039491

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf50KT17hW78.exe

    Filesize

    11KB

    MD5

    7e93bacbbc33e6652e147e7fe07572a0

    SHA1

    421a7167da01c8da4dc4d5234ca3dd84e319e762

    SHA256

    850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

    SHA512

    250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf19Vy96sL31.exe

    Filesize

    364KB

    MD5

    5e67eb7edcaace5d899b76dde9ebf3fc

    SHA1

    b10b57155d4ac2a83e78216f4a7d44b372a4379a

    SHA256

    eefd6accb089c16eec0d44a0e37497f0b25ded905bc3da4706d0e00fc099a117

    SHA512

    9a5489adaf0f449734d0e78b129117232eac6d1693a6b13cedfbe4a4fede13d5ae753a83508ae0d803612d841b712231d9711fb9476c397973b97d0f9183fef4

  • memory/912-14-0x00007FFCE62D3000-0x00007FFCE62D5000-memory.dmp

    Filesize

    8KB

  • memory/912-15-0x00000000001E0000-0x00000000001EA000-memory.dmp

    Filesize

    40KB

  • memory/912-16-0x00007FFCE62D3000-0x00007FFCE62D5000-memory.dmp

    Filesize

    8KB

  • memory/2624-66-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-52-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-24-0x0000000002680000-0x00000000026C4000-memory.dmp

    Filesize

    272KB

  • memory/2624-54-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-64-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-88-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-86-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-84-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-82-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-80-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-78-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-76-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-74-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-72-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-70-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-68-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-22-0x0000000002440000-0x0000000002486000-memory.dmp

    Filesize

    280KB

  • memory/2624-62-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-60-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-58-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-56-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-23-0x0000000004E40000-0x00000000053E4000-memory.dmp

    Filesize

    5.6MB

  • memory/2624-50-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-48-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-46-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-44-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-42-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-40-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-38-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-36-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-34-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-32-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-30-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-28-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-26-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-25-0x0000000002680000-0x00000000026BE000-memory.dmp

    Filesize

    248KB

  • memory/2624-931-0x00000000053F0000-0x0000000005A08000-memory.dmp

    Filesize

    6.1MB

  • memory/2624-932-0x0000000005A10000-0x0000000005B1A000-memory.dmp

    Filesize

    1.0MB

  • memory/2624-933-0x0000000002770000-0x0000000002782000-memory.dmp

    Filesize

    72KB

  • memory/2624-934-0x0000000002790000-0x00000000027CC000-memory.dmp

    Filesize

    240KB

  • memory/2624-935-0x0000000002930000-0x000000000297C000-memory.dmp

    Filesize

    304KB