Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    277s
  • max time network
    257s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30/12/2022, 22:17

General

  • Target

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4.exe

  • Size

    235KB

  • MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

  • SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

  • SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

  • SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • SSDEEP

    6144:IkwjBO99g6779r0psUhmiIuVyD2NgCJgN:1TrOh2uVyCNnS

Malware Config

Extracted

Family

amadey

Version

3.63

C2

62.204.41.91/8kcnjd3da3/index.php

Extracted

Family

redline

Botnet

letgo

C2

80.66.87.13:22346

Attributes
  • auth_value

    9a4217b7e3f4309698e5e6d932e3545e

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detect Amadey credential stealer module 2 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4.exe
    "C:\Users\Admin\AppData\Local\Temp\4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2796
    • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
      "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe" /F
        3⤵
        • Creates scheduled task(s)
        PID:4364
      • C:\Users\Admin\AppData\Local\Temp\1000001001\pypfhc2o51o.exe
        "C:\Users\Admin\AppData\Local\Temp\1000001001\pypfhc2o51o.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4968
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1564 -s 236
          4⤵
          • Program crash
          PID:3168
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • outlook_win_path
        PID:4716
  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    1⤵
    • Executes dropped EXE
    PID:4276
  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    1⤵
    • Executes dropped EXE
    PID:96
  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    1⤵
    • Executes dropped EXE
    PID:3904
  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    1⤵
    • Executes dropped EXE
    PID:2608
  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe
    1⤵
    • Executes dropped EXE
    PID:4892

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1000001001\pypfhc2o51o.exe

    Filesize

    356KB

    MD5

    114738737463a73a549ac1221afd045c

    SHA1

    70feebd89e898537d4ccfe2522e29af1568d4e68

    SHA256

    32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f

    SHA512

    b52490e2c5dd34779715580d5eb885011eee17994a104afb6e1f4a10ba629d09494d89748bf18171ae95cd43a7e02211c8bace8c34343b0e889a6c0ed2d8e135

  • C:\Users\Admin\AppData\Local\Temp\1000001001\pypfhc2o51o.exe

    Filesize

    356KB

    MD5

    114738737463a73a549ac1221afd045c

    SHA1

    70feebd89e898537d4ccfe2522e29af1568d4e68

    SHA256

    32551f9124a359edf3435979372676a4c5bbaeb0423cc3ec53d382abb39d850f

    SHA512

    b52490e2c5dd34779715580d5eb885011eee17994a104afb6e1f4a10ba629d09494d89748bf18171ae95cd43a7e02211c8bace8c34343b0e889a6c0ed2d8e135

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Local\Temp\d003af69b2\nbveek.exe

    Filesize

    235KB

    MD5

    5e445faf7b08cf2ffcac7b38c5d70d5d

    SHA1

    877098531fb4049581a7c81353fc3c7d7dd2083a

    SHA256

    4414a9ba25d52ac38509ccf072d32e4f938990e3b02ca3c2d11fbd5cba433ab4

    SHA512

    9874b8605aafcf7bd46754c2aa0bfbd3e7c14ad0b0791b9d016d828666c4183bc9786390697d6aeaf17d13f1cf615b023c78cff20db35f508d525e15e1e3ae31

  • C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    126KB

    MD5

    4a9e02f2913522b55571d2644800e15b

    SHA1

    9167a2b50bd7357737cf3b06686260736c318f2a

    SHA256

    4a48124561b1a5c5f3c80fc5f5a71d520dc6961f85c9162bd282b5acf4dd3ecc

    SHA512

    844087e9980860ca957bcd6f7d51b9e26d603f61c4cd49d4bd7a33afe6f4f78baf1e483dcef775d908e6a12e43204874a011da44f9ff059edfb44ede541e562b

  • \Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

    Filesize

    126KB

    MD5

    4a9e02f2913522b55571d2644800e15b

    SHA1

    9167a2b50bd7357737cf3b06686260736c318f2a

    SHA256

    4a48124561b1a5c5f3c80fc5f5a71d520dc6961f85c9162bd282b5acf4dd3ecc

    SHA512

    844087e9980860ca957bcd6f7d51b9e26d603f61c4cd49d4bd7a33afe6f4f78baf1e483dcef775d908e6a12e43204874a011da44f9ff059edfb44ede541e562b

  • memory/2796-143-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-153-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-134-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-135-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-136-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-137-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-138-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-139-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-140-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-141-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-142-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-120-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-144-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-145-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-146-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-147-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-148-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-149-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-150-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-151-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-152-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-130-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-154-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-155-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-156-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-157-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-158-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-159-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-160-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-161-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-162-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-132-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-121-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-122-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-123-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-124-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-125-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-126-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-127-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-128-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-131-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-133-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2796-129-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-173-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-183-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-177-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-178-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-179-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-180-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-181-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-182-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-185-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-186-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-184-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-170-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-169-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-175-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-174-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-172-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-165-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-166-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-176-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-167-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/3972-168-0x0000000077570000-0x00000000776FE000-memory.dmp

    Filesize

    1.6MB

  • memory/4968-307-0x0000000009990000-0x0000000009A9A000-memory.dmp

    Filesize

    1.0MB

  • memory/4968-327-0x0000000009D20000-0x0000000009D86000-memory.dmp

    Filesize

    408KB

  • memory/4968-335-0x000000000AE10000-0x000000000AE86000-memory.dmp

    Filesize

    472KB

  • memory/4968-336-0x000000000A880000-0x000000000A8D0000-memory.dmp

    Filesize

    320KB

  • memory/4968-598-0x000000000B5D0000-0x000000000B792000-memory.dmp

    Filesize

    1.8MB

  • memory/4968-599-0x000000000D240000-0x000000000D76C000-memory.dmp

    Filesize

    5.2MB

  • memory/4968-322-0x000000000A910000-0x000000000AE0E000-memory.dmp

    Filesize

    5.0MB

  • memory/4968-321-0x0000000009C80000-0x0000000009D12000-memory.dmp

    Filesize

    584KB

  • memory/4968-313-0x0000000009AA0000-0x0000000009AEB000-memory.dmp

    Filesize

    300KB

  • memory/4968-311-0x0000000009920000-0x000000000995E000-memory.dmp

    Filesize

    248KB

  • memory/4968-309-0x00000000098C0000-0x00000000098D2000-memory.dmp

    Filesize

    72KB

  • memory/4968-306-0x0000000009E00000-0x000000000A406000-memory.dmp

    Filesize

    6.0MB

  • memory/4968-285-0x0000000000400000-0x0000000000432000-memory.dmp

    Filesize

    200KB