Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
127s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11/11/2024, 02:00
Static task
static1
Behavioral task
behavioral1
Sample
21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe
Resource
win10v2004-20241007-en
General
-
Target
21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe
-
Size
1000KB
-
MD5
24dc30daa9b9943c6baa1f249cdf1800
-
SHA1
1544731fa28967736dbd2ba0016998fbcff566de
-
SHA256
21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e
-
SHA512
641b3160c791faef53f0040da178e3517aea3224e2a494ca4d267c5d2d86703897520b8003af13b562420ca2e5339609296cb9e1d6e9bb51183dfb9dc4f1f1f1
-
SSDEEP
24576:Ty2hvlnvHySqydpe7x8lt0Zht3LFYC5ZKSzqQzYfi:m2hvlnKJydpe7GOdLF7Zty
Malware Config
Extracted
redline
dubka
193.233.20.13:4136
-
auth_value
e5a9421183a033f283b2f23139b471f0
Signatures
-
Detects Healer an antivirus disabler dropper 19 IoCs
resource yara_rule behavioral1/files/0x0008000000023c88-26.dat healer behavioral1/memory/232-28-0x0000000000F30000-0x0000000000F3A000-memory.dmp healer behavioral1/memory/3884-34-0x00000000023B0000-0x00000000023CA000-memory.dmp healer behavioral1/memory/3884-36-0x0000000002510000-0x0000000002528000-memory.dmp healer behavioral1/memory/3884-37-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-42-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-64-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-63-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-60-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-59-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-56-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-54-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-52-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-50-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-48-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-46-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-44-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-40-0x0000000002510000-0x0000000002522000-memory.dmp healer behavioral1/memory/3884-38-0x0000000002510000-0x0000000002522000-memory.dmp healer -
Healer family
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection kUS38iO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" kUS38iO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" kUS38iO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" kUS38iO.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection mOj96mp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mOj96mp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" kUS38iO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" kUS38iO.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mOj96mp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mOj96mp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mOj96mp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mOj96mp.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x0007000000023c85-69.dat family_redline behavioral1/memory/4108-71-0x0000000000B00000-0x0000000000B32000-memory.dmp family_redline -
Redline family
-
Executes dropped EXE 6 IoCs
pid Process 2776 dUe1253.exe 32 dak9788.exe 1272 dvf1726.exe 232 kUS38iO.exe 3884 mOj96mp.exe 4108 nYo74cz.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" kUS38iO.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features mOj96mp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" mOj96mp.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" dUe1253.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" dak9788.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" dvf1726.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4000 3884 WerFault.exe 98 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dak9788.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvf1726.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mOj96mp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nYo74cz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dUe1253.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 232 kUS38iO.exe 232 kUS38iO.exe 3884 mOj96mp.exe 3884 mOj96mp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 232 kUS38iO.exe Token: SeDebugPrivilege 3884 mOj96mp.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 548 wrote to memory of 2776 548 21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe 85 PID 548 wrote to memory of 2776 548 21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe 85 PID 548 wrote to memory of 2776 548 21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe 85 PID 2776 wrote to memory of 32 2776 dUe1253.exe 86 PID 2776 wrote to memory of 32 2776 dUe1253.exe 86 PID 2776 wrote to memory of 32 2776 dUe1253.exe 86 PID 32 wrote to memory of 1272 32 dak9788.exe 88 PID 32 wrote to memory of 1272 32 dak9788.exe 88 PID 32 wrote to memory of 1272 32 dak9788.exe 88 PID 1272 wrote to memory of 232 1272 dvf1726.exe 89 PID 1272 wrote to memory of 232 1272 dvf1726.exe 89 PID 1272 wrote to memory of 3884 1272 dvf1726.exe 98 PID 1272 wrote to memory of 3884 1272 dvf1726.exe 98 PID 1272 wrote to memory of 3884 1272 dvf1726.exe 98 PID 32 wrote to memory of 4108 32 dak9788.exe 103 PID 32 wrote to memory of 4108 32 dak9788.exe 103 PID 32 wrote to memory of 4108 32 dak9788.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe"C:\Users\Admin\AppData\Local\Temp\21e0902c31b6b321e9a045be36227c14996f7cc9f4740dd4a8d8d804c699433e.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dUe1253.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dUe1253.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dak9788.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dak9788.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvf1726.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dvf1726.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kUS38iO.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\kUS38iO.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:232
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mOj96mp.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mOj96mp.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3884 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 10126⤵
- Program crash
PID:4000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYo74cz.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nYo74cz.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4108
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3884 -ip 38841⤵PID:4392
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
855KB
MD5266c9c1eaf4536d4e20164c377eedff8
SHA1cc9a3a192a123d63a8111062247b19f8877d2d62
SHA25662fcfe06ee39399e76acc22cca63a954d199f86ae75ce444e22340ad4c74a3e3
SHA5121d1200d3a5c29eb7b8954316d204ef052f6f035cebb1d5f2216b849a49e22be279f84f3a16e1936ca5a7c7d73338b0d5e1bc56614616789f3d190cc7ecaae26c
-
Filesize
500KB
MD537534bf1700bbdfdfcd98b7e1794f38a
SHA10041ea44c9622f018e4e0b35267ee1590ff216ef
SHA2566dcc1b7dc4866004ad9e5a2194bdadf4ece217d8575408be489121cdea5a1b72
SHA512b030f6c53f70210d901977d02884023cdfa787382146cebd1fb30a7890e9a072342cb03e035ff1a64749036b83595dee41e533333e5d0c022a1e2c0cc79a0f4a
-
Filesize
355KB
MD58d39a8d441cfc2c288a6442a8813d888
SHA1901fc52efd48fce037c5a131083e4f64a6d11845
SHA2565c1c79827dcfb2dc3cf90b980acdf15f82c89b87d090e950924ca81dab055a36
SHA5128dabdb72fc9440869186bf23e1b24085c797b25bcd3c1b0d8734a981a6fd94666a99d7596fd2a8dc66dea2b64f34f0604b75691ce40b911cf84ca175a8eb4556
-
Filesize
175KB
MD5dd0c9e110c68ce1fa5308979ef718f7b
SHA1473deb8069f0841d47b74b7f414dacc6f96eca78
SHA256dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3
SHA51229bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236
-
Filesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
Filesize
295KB
MD5304766f61a677814af31d2737d118b6f
SHA1213a7e70d4f7d13e17ddff12152bcfe2c1cc2de4
SHA25607c33396ed7ec1b40808aae921c50c552dc21b08beabbd5541b9fc9f062e08ac
SHA51208c9202e988e4f6518a14f37b19eefc8b5901a2c07472140303c48535b67830e956759db3738b3bf63559220cb1e59f8045a2fad5d84530e9cb2e670740441ea