Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/11/2024, 05:28

General

  • Target

    08e3a74da875746a5e3c058fbf1119a9c03d1ac21243622779780c8ee3e632d3.exe

  • Size

    394KB

  • MD5

    bd3fc4cfdc5390aba3ae069bb4e977cf

  • SHA1

    e29b55a360075753802e8b0e2bd1315567a8d846

  • SHA256

    08e3a74da875746a5e3c058fbf1119a9c03d1ac21243622779780c8ee3e632d3

  • SHA512

    8794ea5b25f562826ceefde97cabf2e2ec30d87a806e4a6e2940044d0b52cc25af1d61f83b2306c35f7926808e2e2a93d68becbd5d4edc7469ea7bc96124a418

  • SSDEEP

    6144:KDy+bnr+Rp0yN90QE6l3Iqp66uwD8NjjO2daa98X7jx6HrfhJkI0iD:RMrhy904l4VNHzway4L5X0iD

Malware Config

Extracted

Family

redline

Botnet

rosn

C2

176.113.115.145:4125

Attributes
  • auth_value

    050a19e1db4d0024b0f23b37dcf961f4

Signatures

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Healer family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 35 IoCs
  • Redline family
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\08e3a74da875746a5e3c058fbf1119a9c03d1ac21243622779780c8ee3e632d3.exe
    "C:\Users\Admin\AppData\Local\Temp\08e3a74da875746a5e3c058fbf1119a9c03d1ac21243622779780c8ee3e632d3.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr726709.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr726709.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3112
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku469043.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku469043.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1684

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jr726709.exe

    Filesize

    13KB

    MD5

    e9ca0cb1ca59b2096deab75ea096f5f6

    SHA1

    6168a026576cd564c32fcf5c29e5fde3389d43a9

    SHA256

    a58f5aa1284c6abfdff790cd36f22ed6f28ddfaa321ed3937544c20e3f67ed0b

    SHA512

    413c9402a3dd13153f51236079bdbc6cdda17847b1d9112a8004cc494738ba80d0fc8a1020579c4eb5e00516b41315ff694dc5bed7a68d2b5d0d5e8024d8aa37

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ku469043.exe

    Filesize

    353KB

    MD5

    fe996a0d8913455a9512c9cf02d022b2

    SHA1

    49d68f44063063392e2ec7e4b178703f63c524ae

    SHA256

    e6d9cafc63c0660752a872c58d3d44b866d61281b12c98a007ef4b9adaf218bd

    SHA512

    e325a01e22b47251fa31e37d15a6f7dc1a053d79d51b54f1b9fb762cbb1a48370163321cd6fe59bafc98186daa45661496880dc7f531d3e14434be9f5342deae

  • memory/1684-15-0x0000000000970000-0x0000000000A70000-memory.dmp

    Filesize

    1024KB

  • memory/1684-16-0x0000000002450000-0x000000000249B000-memory.dmp

    Filesize

    300KB

  • memory/1684-17-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1684-18-0x0000000002710000-0x0000000002756000-memory.dmp

    Filesize

    280KB

  • memory/1684-19-0x0000000004F10000-0x00000000054B4000-memory.dmp

    Filesize

    5.6MB

  • memory/1684-20-0x0000000004E10000-0x0000000004E54000-memory.dmp

    Filesize

    272KB

  • memory/1684-22-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-28-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-84-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-82-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-81-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-78-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-76-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-74-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-73-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-70-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-68-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-66-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-64-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-62-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-60-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-58-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-56-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-54-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-52-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-50-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-48-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-44-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-42-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-41-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-36-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-34-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-33-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-31-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-26-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-24-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-46-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-38-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-21-0x0000000004E10000-0x0000000004E4F000-memory.dmp

    Filesize

    252KB

  • memory/1684-927-0x00000000054C0000-0x0000000005AD8000-memory.dmp

    Filesize

    6.1MB

  • memory/1684-928-0x0000000005AE0000-0x0000000005BEA000-memory.dmp

    Filesize

    1.0MB

  • memory/1684-929-0x0000000005C20000-0x0000000005C32000-memory.dmp

    Filesize

    72KB

  • memory/1684-930-0x0000000005C40000-0x0000000005C7C000-memory.dmp

    Filesize

    240KB

  • memory/1684-931-0x0000000005D90000-0x0000000005DDC000-memory.dmp

    Filesize

    304KB

  • memory/1684-932-0x0000000000970000-0x0000000000A70000-memory.dmp

    Filesize

    1024KB

  • memory/1684-933-0x0000000002450000-0x000000000249B000-memory.dmp

    Filesize

    300KB

  • memory/1684-935-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/3112-7-0x00007FFC0ED53000-0x00007FFC0ED55000-memory.dmp

    Filesize

    8KB

  • memory/3112-8-0x00000000004C0000-0x00000000004CA000-memory.dmp

    Filesize

    40KB

  • memory/3112-9-0x00007FFC0ED53000-0x00007FFC0ED55000-memory.dmp

    Filesize

    8KB