Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 01:56
Static task
static1
Behavioral task
behavioral1
Sample
b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe
Resource
win10v2004-20241007-en
General
-
Target
b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe
-
Size
532KB
-
MD5
5f29f3262913fb21d2f6990e042ea1c5
-
SHA1
098541222a5316cdb4ebec8a1e6fd287365c9615
-
SHA256
b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a
-
SHA512
707ea7d3dbce0023fcf27ef2090b7466a93cfc5fbbad7de35ee0641d61f5aa8c44f8146bb880490bc40070f1cb586404edaf27d6e84eb8238d076d3bf7dbb811
-
SSDEEP
12288:oMroy908elZw/3tF/rEp+ce4lT/BxYosHXGgWEN5bwilui9GrH9:wyAlWPtZie4tbPs3G8nbye4
Malware Config
Extracted
redline
rulit
pedigj.eu:4162
-
auth_value
f4df9ef56871d4ac883b282abaf635e0
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
resource yara_rule behavioral1/files/0x000b000000023b5a-12.dat healer behavioral1/memory/3300-15-0x0000000000EA0000-0x0000000000EAA000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection sf78ek39Uv59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" sf78ek39Uv59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" sf78ek39Uv59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" sf78ek39Uv59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" sf78ek39Uv59.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" sf78ek39Uv59.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
resource yara_rule behavioral1/memory/2916-22-0x0000000004AA0000-0x0000000004AE6000-memory.dmp family_redline behavioral1/memory/2916-24-0x0000000005150000-0x0000000005194000-memory.dmp family_redline behavioral1/memory/2916-26-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-40-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-88-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-86-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-84-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-82-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-80-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-78-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-76-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-74-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-72-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-70-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-66-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-64-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-62-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-60-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-58-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-56-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-54-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-52-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-50-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-48-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-46-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-44-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-38-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-36-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-34-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-32-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-30-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-28-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-68-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-42-0x0000000005150000-0x000000000518E000-memory.dmp family_redline behavioral1/memory/2916-25-0x0000000005150000-0x000000000518E000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 3 IoCs
pid Process 1352 vhsF3757Op.exe 3300 sf78ek39Uv59.exe 2916 tf96XY83Qu54.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" sf78ek39Uv59.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" vhsF3757Op.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhsF3757Op.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tf96XY83Qu54.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3300 sf78ek39Uv59.exe 3300 sf78ek39Uv59.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3300 sf78ek39Uv59.exe Token: SeDebugPrivilege 2916 tf96XY83Qu54.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4296 wrote to memory of 1352 4296 b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe 83 PID 4296 wrote to memory of 1352 4296 b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe 83 PID 4296 wrote to memory of 1352 4296 b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe 83 PID 1352 wrote to memory of 3300 1352 vhsF3757Op.exe 85 PID 1352 wrote to memory of 3300 1352 vhsF3757Op.exe 85 PID 1352 wrote to memory of 2916 1352 vhsF3757Op.exe 92 PID 1352 wrote to memory of 2916 1352 vhsF3757Op.exe 92 PID 1352 wrote to memory of 2916 1352 vhsF3757Op.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe"C:\Users\Admin\AppData\Local\Temp\b4c20fb62bd4928bde782b1eb4a893f30c5c83849967a51a9473093ebb8b384a.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsF3757Op.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vhsF3757Op.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78ek39Uv59.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sf78ek39Uv59.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf96XY83Qu54.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tf96XY83Qu54.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2916
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
387KB
MD50e845c1e36e25523e676a49eb47af7e6
SHA110fdc9feb5261c0a398753d9e0e286d62c59a4aa
SHA25622fb83aa5a6a1edad46ed3f2fe6350bbe0eed6e3ec1d402f0fb2e920a931efb6
SHA5128b0efecb42a66e65b3f1927afa73e96af190d0b44594e824aaaf2c510cc59857a620c55b323f34b24180ce217f094ba65c52499333bc14fcbe6fc3e227d991e6
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
361KB
MD58dbe8b801bee88e19e8b2b5d07124438
SHA11d26dfec8a84dfb092bbf2f9f1eea8c1c11263fd
SHA256a7f2f292d3c188e4b840e00029b9c53332ce6bfac4a15399674c2ae3e33dc79d
SHA512c54ed890c618f3cb76e1dd38d087393bd530d650d7dc53755ba4b2bba929cb4e3b9389017964676a18541df42d15fae5993f04de767854a8655a617283106f33