Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2023, 08:51

General

  • Target

    4103ec6f4d261f5048bb2be55e34d70b.exe

  • Size

    725KB

  • MD5

    4103ec6f4d261f5048bb2be55e34d70b

  • SHA1

    02b24db9232a446ef3a26263a36eda915c101743

  • SHA256

    1c7c5ce03a60a68effe4997c8d6117eed669d3230e601097e22d99da49d0bcdd

  • SHA512

    a8f798ef59831e6650a55cd9e2fef8f5f53e1aff4963c882e86dd39144a69118a5038659bbcef3d1decc4e0e6267275a706b84cb6552e18434e49bf55f0cc6db

  • SSDEEP

    12288:xMrTy90KrboGQdL1fiqznHAaD0vDL6JupLuF4K+KRjUN3PD6QH+LVSmd+XRb:Oyjfo3dLtnHAaD0vDLu0LuF4KKP+QYS/

Malware Config

Extracted

Family

redline

Botnet

fukia

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5783636fbd9e4f0cf9a017bce02e67e

Extracted

Family

amadey

Version

3.66

C2

62.204.41.5/Bu58Ngs/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4103ec6f4d261f5048bb2be55e34d70b.exe
    "C:\Users\Admin\AppData\Local\Temp\4103ec6f4d261f5048bb2be55e34d70b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sek87TA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sek87TA.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2716
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\scB29hK.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\scB29hK.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3924
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kBN13Pu.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kBN13Pu.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2036
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mgE04.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mgE04.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
            "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:216
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:3712
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\5eb6b96734" /P "Admin:N"&&CACLS "..\5eb6b96734" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3964
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:3776
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "mnolyk.exe" /P "Admin:N"
                  7⤵
                    PID:5076
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "mnolyk.exe" /P "Admin:R" /E
                    7⤵
                      PID:1020
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:1468
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\5eb6b96734" /P "Admin:N"
                        7⤵
                          PID:4156
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\5eb6b96734" /P "Admin:R" /E
                          7⤵
                            PID:3512
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:4664
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ntd03Aq.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ntd03Aq.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2140
              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:4260
              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
                C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe
                1⤵
                • Executes dropped EXE
                PID:536

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\5eb6b96734\mnolyk.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sek87TA.exe

                Filesize

                622KB

                MD5

                e43d8d9f7a9cbbb6912fc34f56672895

                SHA1

                f975a4cb7186e4a0209ca444dc04c6a4a4f214e8

                SHA256

                7610d88af8bb6f43841892d350729b838898aa7b94e598f20fb163972538fff1

                SHA512

                3236869f888adc438a4aa4ea17a3a3901c221bb21836f085f5762f19aba9e45993b0b63aed754c3526719b91a41846383d068bedf3ba5be93a5915d281b650e4

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sek87TA.exe

                Filesize

                622KB

                MD5

                e43d8d9f7a9cbbb6912fc34f56672895

                SHA1

                f975a4cb7186e4a0209ca444dc04c6a4a4f214e8

                SHA256

                7610d88af8bb6f43841892d350729b838898aa7b94e598f20fb163972538fff1

                SHA512

                3236869f888adc438a4aa4ea17a3a3901c221bb21836f085f5762f19aba9e45993b0b63aed754c3526719b91a41846383d068bedf3ba5be93a5915d281b650e4

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ntd03Aq.exe

                Filesize

                305KB

                MD5

                a97676767e51104d57e1d0ad956e4274

                SHA1

                518c54685f9d461424f96247c32d1d9db20fea32

                SHA256

                c5ab3172fb7e5ced3b6d009742e00e48698714a2c54f887eb80d15c12b8a6558

                SHA512

                0fad6360d1ac0f729181738ee02fa242ff925de13f64deea9bd0af4b2ee1e1891dfa952698fa1d8318e468c4a30908ef33ad592fb675d0521f5296828aafb87d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ntd03Aq.exe

                Filesize

                305KB

                MD5

                a97676767e51104d57e1d0ad956e4274

                SHA1

                518c54685f9d461424f96247c32d1d9db20fea32

                SHA256

                c5ab3172fb7e5ced3b6d009742e00e48698714a2c54f887eb80d15c12b8a6558

                SHA512

                0fad6360d1ac0f729181738ee02fa242ff925de13f64deea9bd0af4b2ee1e1891dfa952698fa1d8318e468c4a30908ef33ad592fb675d0521f5296828aafb87d

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\scB29hK.exe

                Filesize

                286KB

                MD5

                1772f7bf55bf4640daf4b29c2c934e65

                SHA1

                a84ec109816381d16e691793d304232180f2100e

                SHA256

                7ad7b805ccd0575d396b0b68715b2011f125c24bb15afe3926a6f086215a376d

                SHA512

                78fcab65ea6ce8537652382a89350577c0341ade76619433c985b9eb2adfac5824a8ebefb4635864570d95d8aacfcb8b377bad5a3537f4d726123f0cd9282f6a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\scB29hK.exe

                Filesize

                286KB

                MD5

                1772f7bf55bf4640daf4b29c2c934e65

                SHA1

                a84ec109816381d16e691793d304232180f2100e

                SHA256

                7ad7b805ccd0575d396b0b68715b2011f125c24bb15afe3926a6f086215a376d

                SHA512

                78fcab65ea6ce8537652382a89350577c0341ade76619433c985b9eb2adfac5824a8ebefb4635864570d95d8aacfcb8b377bad5a3537f4d726123f0cd9282f6a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kBN13Pu.exe

                Filesize

                175KB

                MD5

                a5f5c5d6291c7ae9e1d1b7ed1e551490

                SHA1

                3d06413341893b838549939e15f8f1eec423d71a

                SHA256

                1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

                SHA512

                d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kBN13Pu.exe

                Filesize

                175KB

                MD5

                a5f5c5d6291c7ae9e1d1b7ed1e551490

                SHA1

                3d06413341893b838549939e15f8f1eec423d71a

                SHA256

                1a09ce1cb64219a5d88e57845dc9ba6631efa06fccc8867ccf94eb132947563e

                SHA512

                d9b3ba67bdd615ee2ce91a29cd9cf6723464be27bf45186fd0e9559ff2b0e7c51b423cfc3e32b5e90955046fb75a34c4a8528df7294b6c831ca254a65d2b8ba2

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mgE04.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\mgE04.exe

                Filesize

                236KB

                MD5

                fde8915d251fada3a37530421eb29dcf

                SHA1

                44386a8947ddfab993409945dae05a772a13e047

                SHA256

                6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116

                SHA512

                ffc253ad4308c7a34ec5ced45cc5eda21a43a9fa59927a323829e2e87a0060c93a051c726f2f6f65ffdb8ac9666f88bf2622c975a24a6718c99ac9a44c6fd7fd

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                9221a421a3e777eb7d4ce55e474bcc4a

                SHA1

                c96d7bd7ccbf9352d50527bff472595b3dc5298e

                SHA256

                10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8

                SHA512

                63ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                9221a421a3e777eb7d4ce55e474bcc4a

                SHA1

                c96d7bd7ccbf9352d50527bff472595b3dc5298e

                SHA256

                10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8

                SHA512

                63ac172cb19c7c020676937cb35e853710d08e99e06e8cdcb410c37e0c9056af409a50fdec0c90a3c532edcf5e0f128fa1e2181063e1208d4fc4643b1b5736f3

              • memory/2036-143-0x0000000005080000-0x000000000518A000-memory.dmp

                Filesize

                1.0MB

              • memory/2036-144-0x0000000004FB0000-0x0000000004FC2000-memory.dmp

                Filesize

                72KB

              • memory/2036-151-0x0000000006350000-0x00000000063C6000-memory.dmp

                Filesize

                472KB

              • memory/2036-150-0x0000000006EC0000-0x00000000073EC000-memory.dmp

                Filesize

                5.2MB

              • memory/2036-149-0x0000000006180000-0x0000000006342000-memory.dmp

                Filesize

                1.8MB

              • memory/2036-148-0x0000000005F10000-0x0000000005FA2000-memory.dmp

                Filesize

                584KB

              • memory/2036-147-0x00000000063E0000-0x0000000006984000-memory.dmp

                Filesize

                5.6MB

              • memory/2036-141-0x00000000005E0000-0x0000000000612000-memory.dmp

                Filesize

                200KB

              • memory/2036-146-0x0000000005320000-0x0000000005386000-memory.dmp

                Filesize

                408KB

              • memory/2036-145-0x0000000005040000-0x000000000507C000-memory.dmp

                Filesize

                240KB

              • memory/2036-142-0x0000000005500000-0x0000000005B18000-memory.dmp

                Filesize

                6.1MB

              • memory/2036-152-0x0000000006A90000-0x0000000006AE0000-memory.dmp

                Filesize

                320KB

              • memory/2140-170-0x0000000000751000-0x000000000077F000-memory.dmp

                Filesize

                184KB

              • memory/2140-171-0x0000000000650000-0x000000000069B000-memory.dmp

                Filesize

                300KB

              • memory/2140-173-0x0000000000751000-0x000000000077F000-memory.dmp

                Filesize

                184KB

              • memory/2140-172-0x0000000000400000-0x000000000057D000-memory.dmp

                Filesize

                1.5MB