Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2023, 10:47

General

  • Target

    file.exe

  • Size

    714KB

  • MD5

    0b4e0ff9bb68c7d337df284eb1f318d6

  • SHA1

    635e9adafd773ed0844cdb8854fdd384d4dc5119

  • SHA256

    1e2ed693393782810af0ab0ea37fd11e27749fedf85451fd0d1abb01bd73bbff

  • SHA512

    ce275cf2ce5680e00878cec176f23650194608c3f3987898c349c324b87102d916751a5a4294911b9bbad0c6e7cf2000b1c7b83807d0a592628d23dadc86749d

  • SSDEEP

    12288:lMrVy90uj82Z99MMPs4v5NHuheoTjExFw4CPJN6PPMLKvvUBXMvnc11/dDarG3i4:8yF82Z99M565NHugCBYpqcvnWcI

Malware Config

Extracted

Family

redline

Botnet

dubka

C2

193.233.20.13:4136

Attributes
  • auth_value

    e5a9421183a033f283b2f23139b471f0

Extracted

Family

amadey

Version

3.66

C2

193.233.20.2/Bn89hku/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:444
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gHJ30ve.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gHJ30ve.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3544
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gBV99TS.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gBV99TS.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4776
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\anl66dY.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\anl66dY.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2688
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbl04FI.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbl04FI.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1444
          • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
            "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4948
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4148
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "Admin:N"&&CACLS "..\4b9a106e76" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:260
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:3264
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "mnolyk.exe" /P "Admin:N"
                  7⤵
                    PID:1132
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "mnolyk.exe" /P "Admin:R" /E
                    7⤵
                      PID:3772
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4260
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\4b9a106e76" /P "Admin:N"
                        7⤵
                          PID:3644
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\4b9a106e76" /P "Admin:R" /E
                          7⤵
                            PID:3172
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:4040
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUl6799.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUl6799.exe
                    3⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2120
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1324
                      4⤵
                      • Program crash
                      PID:3476
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fyF62.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fyF62.exe
                  2⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Executes dropped EXE
                  • Windows security modification
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1784
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2120 -ip 2120
                1⤵
                  PID:2372
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3068
                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4888

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\4b9a106e76\mnolyk.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fyF62.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fyF62.exe

                  Filesize

                  11KB

                  MD5

                  7e93bacbbc33e6652e147e7fe07572a0

                  SHA1

                  421a7167da01c8da4dc4d5234ca3dd84e319e762

                  SHA256

                  850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                  SHA512

                  250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gHJ30ve.exe

                  Filesize

                  610KB

                  MD5

                  c7614615de3cbb333d29dfb381c4d0ef

                  SHA1

                  f6705fdfdee4ef5bf64aac4512fdbf14d8a83031

                  SHA256

                  949f9427de53ab0ead5b502bd0634e9abf3260a747ec741688375420ace46fe3

                  SHA512

                  5c9b45c154897cc6f6129e174eb7235a43d99bfca6ea8727b1e127d0183c97f786f6db187e6730445882486bdfb8477ee62fcf15742b32439120bdcdaeffd633

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gHJ30ve.exe

                  Filesize

                  610KB

                  MD5

                  c7614615de3cbb333d29dfb381c4d0ef

                  SHA1

                  f6705fdfdee4ef5bf64aac4512fdbf14d8a83031

                  SHA256

                  949f9427de53ab0ead5b502bd0634e9abf3260a747ec741688375420ace46fe3

                  SHA512

                  5c9b45c154897cc6f6129e174eb7235a43d99bfca6ea8727b1e127d0183c97f786f6db187e6730445882486bdfb8477ee62fcf15742b32439120bdcdaeffd633

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUl6799.exe

                  Filesize

                  278KB

                  MD5

                  5e7ad96227ac97ea047c202bab0a79dd

                  SHA1

                  700c285600d0d8324660dac5326eaae1b1891645

                  SHA256

                  1e55c8ff6e68cb300f581fd5003dd36f35835d00f9c8938a3a0eb9b7cded4875

                  SHA512

                  27af17d76db10679b00a15ef754ebc41e830bc4fbcd93073d1cfba416824e800da10e636bd44ce8f177281c4a706c41c9af58ea82e9db54c81d038d7b18af08f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dUl6799.exe

                  Filesize

                  278KB

                  MD5

                  5e7ad96227ac97ea047c202bab0a79dd

                  SHA1

                  700c285600d0d8324660dac5326eaae1b1891645

                  SHA256

                  1e55c8ff6e68cb300f581fd5003dd36f35835d00f9c8938a3a0eb9b7cded4875

                  SHA512

                  27af17d76db10679b00a15ef754ebc41e830bc4fbcd93073d1cfba416824e800da10e636bd44ce8f177281c4a706c41c9af58ea82e9db54c81d038d7b18af08f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gBV99TS.exe

                  Filesize

                  285KB

                  MD5

                  17559bb2092cb3e1c88bb59983337ea3

                  SHA1

                  ce398c56819807343ffa52cb5a63c7be8da58810

                  SHA256

                  fb2ceab656059e904423467a271af67c3ac573d9163f278d7ec741505a0092bd

                  SHA512

                  7b9b87360eec78c2121193a38fa59593e919807312d23c075999c9d619fbec4e744b376edf7a6af5fb739643e266c51a293157f98cfcd4407ae38fc7fc2f0602

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\gBV99TS.exe

                  Filesize

                  285KB

                  MD5

                  17559bb2092cb3e1c88bb59983337ea3

                  SHA1

                  ce398c56819807343ffa52cb5a63c7be8da58810

                  SHA256

                  fb2ceab656059e904423467a271af67c3ac573d9163f278d7ec741505a0092bd

                  SHA512

                  7b9b87360eec78c2121193a38fa59593e919807312d23c075999c9d619fbec4e744b376edf7a6af5fb739643e266c51a293157f98cfcd4407ae38fc7fc2f0602

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\anl66dY.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\anl66dY.exe

                  Filesize

                  175KB

                  MD5

                  dd0c9e110c68ce1fa5308979ef718f7b

                  SHA1

                  473deb8069f0841d47b74b7f414dacc6f96eca78

                  SHA256

                  dc28c9d9ab3f30222ed59f3991c5981bec40604e725ece488d8599eef917a7b3

                  SHA512

                  29bd76da816b13b31c938a3f8699d2f5942a24c9ef61fddcac490e0a30f82c1a4a76ca9a6866a8d2c8e57566f66b3aea31e7f70646d3ebef63c63a06f8fe2236

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbl04FI.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\bbl04FI.exe

                  Filesize

                  236KB

                  MD5

                  52fca4d08faccbd7d3f9a487158ed24a

                  SHA1

                  999297fae9adaaca1f2163e45aa4100ebe2a27f6

                  SHA256

                  6ef9b879049e0e8490811b7a90ccd47de82b17ba7e9850485e035780e474ff14

                  SHA512

                  7669fca02637a8d02b53837b0bc62025625d7615c275414412ecd0d4f0d6377c588a401e11d637abd1b10269ba813555a6600cebe8657ec78f104f350d4a0368

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll

                  Filesize

                  89KB

                  MD5

                  8c5b3a2beac24f9a4878c50ce26c4623

                  SHA1

                  e223a25b65a685c5be974ab1865e03497f64bda0

                  SHA256

                  c33434b1f889a5351cbe18ec31b424d224772303ebdb7331e1fd9f973d8661c4

                  SHA512

                  b2028e8cbdb105e79e4c86665ae26f47a2c479740e136b250c0587064de974563c380f1efb272dfef593ad8d2daaf32b484ddc17dbf5c5501287be76610cb0f6

                • memory/1784-179-0x0000000000E20000-0x0000000000E2A000-memory.dmp

                  Filesize

                  40KB

                • memory/1784-180-0x00007FFC42B10000-0x00007FFC435D1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/1784-181-0x00007FFC42B10000-0x00007FFC435D1000-memory.dmp

                  Filesize

                  10.8MB

                • memory/2120-171-0x00000000023C0000-0x000000000240B000-memory.dmp

                  Filesize

                  300KB

                • memory/2120-170-0x00000000008E3000-0x0000000000911000-memory.dmp

                  Filesize

                  184KB

                • memory/2120-175-0x0000000000400000-0x0000000000763000-memory.dmp

                  Filesize

                  3.4MB

                • memory/2120-174-0x00000000008E3000-0x0000000000911000-memory.dmp

                  Filesize

                  184KB

                • memory/2120-173-0x00000000008E3000-0x0000000000911000-memory.dmp

                  Filesize

                  184KB

                • memory/2120-172-0x0000000000400000-0x0000000000763000-memory.dmp

                  Filesize

                  3.4MB

                • memory/2688-149-0x0000000007010000-0x00000000071D2000-memory.dmp

                  Filesize

                  1.8MB

                • memory/2688-144-0x0000000005770000-0x0000000005782000-memory.dmp

                  Filesize

                  72KB

                • memory/2688-141-0x0000000000DA0000-0x0000000000DD2000-memory.dmp

                  Filesize

                  200KB

                • memory/2688-142-0x0000000005CC0000-0x00000000062D8000-memory.dmp

                  Filesize

                  6.1MB

                • memory/2688-143-0x0000000005840000-0x000000000594A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/2688-145-0x00000000057F0000-0x000000000582C000-memory.dmp

                  Filesize

                  240KB

                • memory/2688-146-0x0000000005B10000-0x0000000005BA2000-memory.dmp

                  Filesize

                  584KB

                • memory/2688-150-0x0000000007710000-0x0000000007C3C000-memory.dmp

                  Filesize

                  5.2MB

                • memory/2688-147-0x0000000006890000-0x0000000006E34000-memory.dmp

                  Filesize

                  5.6MB

                • memory/2688-151-0x0000000007380000-0x00000000073F6000-memory.dmp

                  Filesize

                  472KB

                • memory/2688-152-0x0000000006F50000-0x0000000006FA0000-memory.dmp

                  Filesize

                  320KB

                • memory/2688-148-0x0000000006350000-0x00000000063B6000-memory.dmp

                  Filesize

                  408KB