Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/11/2024, 02:11 UTC
General
-
Target
8f459a981c0f81b0b54dd4c001d62f490fd70b2125f86338db7cc75a7dd5fb31.exe
-
Size
534KB
-
MD5
52101467c256fd2b66bb9cfcf231f937
-
SHA1
225c516212ac747b6463a90344d241d24fa01c4c
-
SHA256
8f459a981c0f81b0b54dd4c001d62f490fd70b2125f86338db7cc75a7dd5fb31
-
SHA512
5c7fb09d815bcfceaec95ec6cd84f235cd8e5f8ad23154a582d30bc648fccf0df3083bd9db26b4a91eb81b340f1fae37df7f77a9b01b05a5b4234ee498afc7c9
-
SSDEEP
12288:WMrIy90k6NnJwUwDIbNotTbUWpXVqHpDi9CFHlOwH5npM:qyQi0bNEU8FqJD19a
Malware Config
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
Detects Healer an antivirus disabler dropper 2 IoCs
-
Healer
Healer an antivirus disabler dropper.
-
Healer family
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 35 IoCs
-
Redline family
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f459a981c0f81b0b54dd4c001d62f490fd70b2125f86338db7cc75a7dd5fb31.exe"C:\Users\Admin\AppData\Local\Temp\8f459a981c0f81b0b54dd4c001d62f490fd70b2125f86338db7cc75a7dd5fb31.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMX5652.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziMX5652.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr279689.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\jr279689.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku308104.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ku308104.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS240.221.184.93.in-addr.arpaRemote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS30.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
176.113.115.145:4125 -
176.113.115.145:4125
-
176.113.115.145:4125
-
176.113.115.145:4125
-
176.113.115.145:4125
-
176.113.115.145:4125
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53240.221.184.93.in-addr.arpadns
DNS Request
240.221.184.93.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5330.243.111.52.in-addr.arpadns
DNS Request
30.243.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
392KB
MD587ee96932f4facc2a94fbc5e1b3d7aee
SHA10ea218b1c20483f1b628f099475c18d2f053fd34
SHA256bdef3c05b48ca6383d1073ddaaecf8529ab3f0ab08746c45e78960554aff1076
SHA5128d1bd8b67e73afcd4a4db73b79c72079a8a1d3f34e81312969b890e06c4c7fa45fcd5c821fd3bee253520a093da04a952779d30b6c359f3415dc81976ec8f679
-
Filesize
11KB
MD5b78b5dc0c84dc01601e6c148f8630fbd
SHA1a60b5a7c82be01561245f1c7d4f3fb5db3b0d0df
SHA256ae8d23ea29924ba92b9bff0a42c084d7a9099b3a3a7323f0452f88faa210ef7b
SHA5127d3189336a486852068fb968ede4c90e0dd6006f341c28ea1a26b5f299d354d0dd1612ff5d88340f802da613188186b14da0a0b0ba76cfc40645ca201d56e12f
-
Filesize
319KB
MD5710d18b9ca784978d102b358cb17cbe3
SHA175999952a90eba791d85f046738643a03825cffa
SHA256db15f047ed08f5acef4cb816c748f0714d355ab51bcb62d028ad305aa01f8a64
SHA512cebc7eab37db6772def3431992c23a6937ad313929742e5dd5f648161804dbf38768fe4c300cebd2ec81fe8a7a641bb2dc76ddaf9e66a9eed4237c950b13b510
-
Filesize
8KB
-
Filesize
40KB
-
Filesize
8KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
272KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
280KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
5.6MB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
304KB