Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/02/2023, 14:41

General

  • Target

    823ffd3278c8a81b3c07e04b3b7dcb0335a4eb8f68de27b17fae60e676bc548c.exe

  • Size

    783KB

  • MD5

    242f4f5467d7ce3175f4297d160abb5b

  • SHA1

    6d20d85f04c40343ef8262ad898a7425f162d49b

  • SHA256

    823ffd3278c8a81b3c07e04b3b7dcb0335a4eb8f68de27b17fae60e676bc548c

  • SHA512

    fda6882f118a02dd1c29999362855edd82d2c7dfba51113d6edb2b37194ae910bb2258904f723f9d77aeeba0aa4ab135ad356b2bd69ffdf2fa4709d8c2bf0ecf

  • SSDEEP

    12288:qMrtGy90Z359uiA6AmnY2c/0BhUfJqKW66RC6WBkVUYIk9X4:yy+Gi/AmzC0YJI6r6WkVF/l4

Malware Config

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

Extracted

Family

redline

Botnet

romka

C2

193.233.20.11:4131

Attributes
  • auth_value

    fcbb3247051f5290e8ac5b1a841af67b

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\823ffd3278c8a81b3c07e04b3b7dcb0335a4eb8f68de27b17fae60e676bc548c.exe
    "C:\Users\Admin\AppData\Local\Temp\823ffd3278c8a81b3c07e04b3b7dcb0335a4eb8f68de27b17fae60e676bc548c.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2780
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cxp91BD.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cxp91BD.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cDO57Th.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cDO57Th.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4672
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cIo98.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cIo98.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4652
          • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
            "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2464
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:3216
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1004
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:1848
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "mnolyk.exe" /P "Admin:N"
                  7⤵
                    PID:2164
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "mnolyk.exe" /P "Admin:R" /E
                    7⤵
                      PID:2852
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4344
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\5eb6b96734" /P "Admin:N"
                        7⤵
                          PID:4984
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\5eb6b96734" /P "Admin:R" /E
                          7⤵
                            PID:4680
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:4036
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tnp76lQ.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tnp76lQ.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4212
              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:4828

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cxp91BD.exe

                Filesize

                679KB

                MD5

                c1667d9ae6b382de3c5317ab8f9f190a

                SHA1

                c78c7c48685e86f3d276221ff15e7a4eaa54bfcd

                SHA256

                90d9a1f09ce3c645c4a44f6e206d85a9ee44da3241f59f4f546a60cf04f49f38

                SHA512

                463fc655004451ec141e6a4eaf351d2a1c46d09e7dcbdaccdb4e96afe5d5f7ce3a43a1f8c3ac468cb38bb643743ae1712386f6d2a37b55b6be788fac2e821465

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cxp91BD.exe

                Filesize

                679KB

                MD5

                c1667d9ae6b382de3c5317ab8f9f190a

                SHA1

                c78c7c48685e86f3d276221ff15e7a4eaa54bfcd

                SHA256

                90d9a1f09ce3c645c4a44f6e206d85a9ee44da3241f59f4f546a60cf04f49f38

                SHA512

                463fc655004451ec141e6a4eaf351d2a1c46d09e7dcbdaccdb4e96afe5d5f7ce3a43a1f8c3ac468cb38bb643743ae1712386f6d2a37b55b6be788fac2e821465

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cDO57Th.exe

                Filesize

                534KB

                MD5

                327a673661dd1d97298bf7e2744bdca1

                SHA1

                158106add1accd5dd18c95d034d5c1e582e66c4d

                SHA256

                89afce55d3cad1c55b87e494f13b30b2b651e22fddbdb8ca016bd23eba62705b

                SHA512

                48fbd4df5b6bd978bfe71ba90816d0375b3f11a454487c02d587650bf712b76e1977f000dff170115e067a1bb245a8959cd3d50790169982fe6f9625be5db3a6

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cDO57Th.exe

                Filesize

                534KB

                MD5

                327a673661dd1d97298bf7e2744bdca1

                SHA1

                158106add1accd5dd18c95d034d5c1e582e66c4d

                SHA256

                89afce55d3cad1c55b87e494f13b30b2b651e22fddbdb8ca016bd23eba62705b

                SHA512

                48fbd4df5b6bd978bfe71ba90816d0375b3f11a454487c02d587650bf712b76e1977f000dff170115e067a1bb245a8959cd3d50790169982fe6f9625be5db3a6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cIo98.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cIo98.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tnp76lQ.exe

                Filesize

                457KB

                MD5

                d133d935024e27148ff6f13a0f8a8b88

                SHA1

                6b4f786b29cf717793a96f0b9e45e90668105b44

                SHA256

                1860a7903b15326d3fc0e90215561ff6a0c8f7f6cf739d88736e8e320503250b

                SHA512

                80f4b2a92d2fdf750ca991d9f4405c0188eebeb6fc3edd3de8a802cce1530f5b0ceb4840e8485138c2da9d01b5b57d539e44f916b512dad54c688c719511e44a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\tnp76lQ.exe

                Filesize

                457KB

                MD5

                d133d935024e27148ff6f13a0f8a8b88

                SHA1

                6b4f786b29cf717793a96f0b9e45e90668105b44

                SHA256

                1860a7903b15326d3fc0e90215561ff6a0c8f7f6cf739d88736e8e320503250b

                SHA512

                80f4b2a92d2fdf750ca991d9f4405c0188eebeb6fc3edd3de8a802cce1530f5b0ceb4840e8485138c2da9d01b5b57d539e44f916b512dad54c688c719511e44a

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                9221a421a3e777eb7d4ce55e474bcc4a

                SHA1

                c96d7bd7ccbf9352d50527bff472595b3dc5298e

                SHA256

                10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8

                SHA512

                63ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                9221a421a3e777eb7d4ce55e474bcc4a

                SHA1

                c96d7bd7ccbf9352d50527bff472595b3dc5298e

                SHA256

                10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8

                SHA512

                63ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3

              • memory/2780-146-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-125-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-139-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-140-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-141-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-142-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-143-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-144-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-145-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-120-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-147-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-148-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-149-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-150-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-151-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-152-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-153-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-154-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-155-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-156-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-157-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-158-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-159-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-160-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-161-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-162-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-163-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-164-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-165-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-121-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-137-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-122-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-123-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-124-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-138-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-126-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-127-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-136-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-128-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-129-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-130-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-131-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-132-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-133-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-134-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/2780-135-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-178-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-171-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-183-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-182-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-168-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-181-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-180-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-184-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-177-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-176-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-169-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-175-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-173-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-186-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-172-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-185-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-170-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/3500-179-0x0000000077710000-0x000000007789E000-memory.dmp

                Filesize

                1.6MB

              • memory/4212-665-0x00000000058F0000-0x000000000593B000-memory.dmp

                Filesize

                300KB

              • memory/4212-648-0x00000000007D2000-0x0000000000801000-memory.dmp

                Filesize

                188KB

              • memory/4212-583-0x0000000000400000-0x000000000049E000-memory.dmp

                Filesize

                632KB

              • memory/4212-649-0x00000000004A0000-0x00000000005EA000-memory.dmp

                Filesize

                1.3MB

              • memory/4212-639-0x0000000002420000-0x0000000002466000-memory.dmp

                Filesize

                280KB

              • memory/4212-643-0x0000000004A50000-0x0000000004F4E000-memory.dmp

                Filesize

                5.0MB

              • memory/4212-645-0x00000000024C0000-0x0000000002504000-memory.dmp

                Filesize

                272KB

              • memory/4212-577-0x00000000007D2000-0x0000000000801000-memory.dmp

                Filesize

                188KB

              • memory/4212-580-0x00000000004A0000-0x00000000005EA000-memory.dmp

                Filesize

                1.3MB

              • memory/4212-658-0x0000000004FB0000-0x00000000055B6000-memory.dmp

                Filesize

                6.0MB

              • memory/4212-659-0x0000000005640000-0x000000000574A000-memory.dmp

                Filesize

                1.0MB

              • memory/4212-661-0x0000000005780000-0x0000000005792000-memory.dmp

                Filesize

                72KB

              • memory/4212-663-0x00000000057A0000-0x00000000057DE000-memory.dmp

                Filesize

                248KB