Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30/06/2021, 09:04
Static task
static1
Behavioral task
behavioral1
Sample
DC2AD73D29C4F13A9DA18F327625A6C7.exe
Resource
win7v20210408
General
-
Target
DC2AD73D29C4F13A9DA18F327625A6C7.exe
-
Size
3.1MB
-
MD5
dc2ad73d29c4f13a9da18f327625a6c7
-
SHA1
4987698425e4e43a34312cfed51de09dea333f16
-
SHA256
5f48c241c815060c266f3ad4eaf267ecb0026af7369a91125b87c7e079ca3aa4
-
SHA512
7f02a08c918f079ac8eae9fcf422f8eea27d0f08761a4168ee11139c675196055f583711326625e76def63211d3c28273c05e4f3a7bd2be33471ce39000b886e
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com
-
profile_id
706
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral1/memory/1068-151-0x0000000000417F26-mapping.dmp family_redline behavioral1/memory/1068-150-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1068-157-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1648-196-0x0000000000380000-0x00000000003A4000-memory.dmp family_redline -
Vidar Stealer 2 IoCs
resource yara_rule behavioral1/memory/580-156-0x00000000022F0000-0x000000000238D000-memory.dmp family_vidar behavioral1/memory/580-192-0x0000000000400000-0x0000000000950000-memory.dmp family_vidar -
resource yara_rule behavioral1/files/0x00030000000130d8-61.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-62.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-63.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-65.dat aspack_v212_v242 behavioral1/files/0x00030000000130d4-66.dat aspack_v212_v242 behavioral1/files/0x00030000000130d3-68.dat aspack_v212_v242 behavioral1/files/0x00030000000130d4-67.dat aspack_v212_v242 behavioral1/files/0x00030000000130d3-69.dat aspack_v212_v242 behavioral1/files/0x00030000000130d6-74.dat aspack_v212_v242 behavioral1/files/0x00030000000130d6-75.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-77.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-80.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-79.dat aspack_v212_v242 behavioral1/files/0x00030000000130d8-78.dat aspack_v212_v242 -
Executes dropped EXE 8 IoCs
pid Process 1168 setup_install.exe 580 arnatic_1.exe 568 arnatic_3.exe 1072 arnatic_4.exe 1776 arnatic_5.exe 548 arnatic_6.exe 1516 arnatic_7.exe 1068 arnatic_7.exe -
Loads dropped DLL 26 IoCs
pid Process 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 1168 setup_install.exe 1168 setup_install.exe 1168 setup_install.exe 1168 setup_install.exe 1168 setup_install.exe 1168 setup_install.exe 1168 setup_install.exe 1168 setup_install.exe 1736 cmd.exe 1736 cmd.exe 1356 cmd.exe 788 cmd.exe 580 arnatic_1.exe 580 arnatic_1.exe 1004 cmd.exe 1304 cmd.exe 1464 cmd.exe 1464 cmd.exe 1516 arnatic_7.exe 1516 arnatic_7.exe 1516 arnatic_7.exe 1068 arnatic_7.exe 1068 arnatic_7.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ip-api.com 52 ipinfo.io 53 ipinfo.io -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1516 set thread context of 1068 1516 arnatic_7.exe 41 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 2388 580 WerFault.exe 40 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1776 arnatic_5.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1996 wrote to memory of 1168 1996 DC2AD73D29C4F13A9DA18F327625A6C7.exe 26 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1736 1168 setup_install.exe 28 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1712 1168 setup_install.exe 29 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 1356 1168 setup_install.exe 30 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 788 1168 setup_install.exe 31 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1168 wrote to memory of 1004 1168 setup_install.exe 32 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1736 wrote to memory of 580 1736 cmd.exe 40 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1168 wrote to memory of 1304 1168 setup_install.exe 33 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1356 wrote to memory of 568 1356 cmd.exe 39 PID 1168 wrote to memory of 1464 1168 setup_install.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\DC2AD73D29C4F13A9DA18F327625A6C7.exe"C:\Users\Admin\AppData\Local\Temp\DC2AD73D29C4F13A9DA18F327625A6C7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_1.exearnatic_1.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 9645⤵
- Program crash
PID:2388
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe3⤵PID:1712
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_3.exearnatic_3.exe4⤵
- Executes dropped EXE
PID:568
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe3⤵
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_4.exearnatic_4.exe4⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:2240
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe3⤵
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_5.exearnatic_5.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1776 -
C:\Users\Admin\AppData\Roaming\3812442.exe"C:\Users\Admin\AppData\Roaming\3812442.exe"5⤵PID:524
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"6⤵PID:1980
-
-
-
C:\Users\Admin\AppData\Roaming\5992314.exe"C:\Users\Admin\AppData\Roaming\5992314.exe"5⤵PID:1780
-
-
C:\Users\Admin\AppData\Roaming\1779423.exe"C:\Users\Admin\AppData\Roaming\1779423.exe"5⤵PID:1648
-
-
C:\Users\Admin\AppData\Roaming\7825650.exe"C:\Users\Admin\AppData\Roaming\7825650.exe"5⤵PID:1972
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe3⤵
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_6.exearnatic_6.exe4⤵
- Executes dropped EXE
PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe3⤵
- Loads dropped DLL
PID:1464
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_7.exearnatic_7.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zSCC7B9194\arnatic_7.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068
-