Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe
Resource
win10v2004-20241007-en
General
-
Target
751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe
-
Size
546KB
-
MD5
7077fae9bb69642a5b584f5ba1b572d8
-
SHA1
09babde17a62d44a2945dc8422a77d7ab9f5e2b9
-
SHA256
751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4
-
SHA512
0226fc44a339b3e99ac117683997514bb5dfbb42be5523d1f63fc8661973b93577e17b72ba2634ebddca9b18e449604b26fbc79240c5e2f41b8a0e1fd3770c65
-
SSDEEP
12288:wMrdy90QXN7vDShfKICFHvL28daK1YystlwLMFhq+0ueuWWzJ:9yJN7LSNdCFHJCPskvTjJ
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b87-12.dat healer behavioral1/memory/392-15-0x00000000003D0000-0x00000000003DA000-memory.dmp healer -
Healer family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" h27KY58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" h27KY58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" h27KY58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection h27KY58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" h27KY58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" h27KY58.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/1692-22-0x00000000027F0000-0x0000000002836000-memory.dmp family_redline behavioral1/memory/1692-24-0x0000000004CF0000-0x0000000004D34000-memory.dmp family_redline behavioral1/memory/1692-25-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-38-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-88-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-86-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-84-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-82-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-80-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-76-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-74-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-72-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-70-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-68-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-66-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-64-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-62-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-60-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-58-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-56-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-52-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-51-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-48-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-47-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-44-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-42-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-40-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-36-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-34-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-32-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-31-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-28-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-26-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-78-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline behavioral1/memory/1692-54-0x0000000004CF0000-0x0000000004D2E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 2084 niba5209.exe 392 h27KY58.exe 1692 ifBXM06.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" h27KY58.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" niba5209.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language niba5209.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ifBXM06.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 392 h27KY58.exe 392 h27KY58.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 392 h27KY58.exe Token: SeDebugPrivilege 1692 ifBXM06.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2084 1580 751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe 83 PID 1580 wrote to memory of 2084 1580 751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe 83 PID 1580 wrote to memory of 2084 1580 751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe 83 PID 2084 wrote to memory of 392 2084 niba5209.exe 84 PID 2084 wrote to memory of 392 2084 niba5209.exe 84 PID 2084 wrote to memory of 1692 2084 niba5209.exe 95 PID 2084 wrote to memory of 1692 2084 niba5209.exe 95 PID 2084 wrote to memory of 1692 2084 niba5209.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe"C:\Users\Admin\AppData\Local\Temp\751b08ea863f4ff0ac25d2bc9609c9ceb696020c8c518adf871aaef7c61399a4.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5209.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\niba5209.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h27KY58.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h27KY58.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:392
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ifBXM06.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ifBXM06.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
404KB
MD59d063ff2376db30e7ec2306112849658
SHA1cf1295f93cf7d3fed54eb9ca44bcfa286e94e78a
SHA256b6f7c3089e87e3d76dbbd973a657bfaf9c202b93032becd6760dcc558712fb34
SHA512b55bb7a1310b4772976e2d4dda549cd3b93ce2600052f500c02ffcbd1b61b5186634ff5483a2ab662723cc0a933541d77966688a25aff0cddd07cdec62f9c894
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
358KB
MD59f8950164931acb5f983538fde0c8769
SHA1699bb8e2136691537d7b6bf3a1135f802b1ab4cd
SHA2569c73b0a223a036c3741cff738788a748252c08fe33808ea069d69b04e4031679
SHA51248a4426a157f714fdda881e3f1a442cf3bad44009bc41f9cfb6152f5e1d0695c7087fcfaa73cff4c64fe9001357b6fef4af433759cc4b7b396ebabe089f779c8