Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    171s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 20:30

General

  • Target

    f4c3ad74e138f66b72ea1591552a72eab30dcfd409902a14f99c159fcb9cda97.exe

  • Size

    1.1MB

  • MD5

    dfcb9ad3bb5c4f8ca4928eaa87c55a85

  • SHA1

    48622dd99d34ff918876e7a950758c6d50d233e4

  • SHA256

    f4c3ad74e138f66b72ea1591552a72eab30dcfd409902a14f99c159fcb9cda97

  • SHA512

    d19efe6b7b35fda1f99352597f15a4ee5e68ae3ba68291072105d6af4143bf83d5f2a1ad2bb658935e89daebef49a6026962783f902b02fc2abd784034128e80

  • SSDEEP

    24576:TycGFZvCy1R55vGKQCn/pbN4JddI50qdEU5GrUQHIriA:mcmCIPOKQwpQdTqtg

Malware Config

Extracted

Family

amadey

Version

3.70

C2

212.113.119.255/joomla/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Redline Stealer samples 1 IoCs

    This rule detects the presence of Redline Stealer samples based on their unique strings.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 11 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4c3ad74e138f66b72ea1591552a72eab30dcfd409902a14f99c159fcb9cda97.exe
    "C:\Users\Admin\AppData\Local\Temp\f4c3ad74e138f66b72ea1591552a72eab30dcfd409902a14f99c159fcb9cda97.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4276
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za822388.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za822388.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4984
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za927548.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za927548.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2828
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za852115.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za852115.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:408
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55984350.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55984350.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3544
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u16371270.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u16371270.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2252
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 1076
              6⤵
              • Program crash
              PID:732
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w24RT54.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w24RT54.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4624
          • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
            "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2152
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:1032
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xdNqk42.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xdNqk42.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3168
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2252 -ip 2252
    1⤵
      PID:1408
    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe
      1⤵
      • Executes dropped EXE
      PID:4864

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      3308051ded87b1863a8d92925202c4b3

      SHA1

      7834ddc23e7976b07118fb580ae38234466dbdfb

      SHA256

      13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

      SHA512

      f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      3308051ded87b1863a8d92925202c4b3

      SHA1

      7834ddc23e7976b07118fb580ae38234466dbdfb

      SHA256

      13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

      SHA512

      f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      3308051ded87b1863a8d92925202c4b3

      SHA1

      7834ddc23e7976b07118fb580ae38234466dbdfb

      SHA256

      13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

      SHA512

      f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

    • C:\Users\Admin\AppData\Local\Temp\5cb6818d6c\oneetx.exe

      Filesize

      229KB

      MD5

      3308051ded87b1863a8d92925202c4b3

      SHA1

      7834ddc23e7976b07118fb580ae38234466dbdfb

      SHA256

      13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

      SHA512

      f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za822388.exe

      Filesize

      969KB

      MD5

      6a57476cf838f2ac33b753cee96fd224

      SHA1

      8974d6451384c86318d5aff6c3191c7b28827dd2

      SHA256

      26b8c3ca8a995bbda9997993e07559dd995b075f75a43b914b1d63cd05be40e9

      SHA512

      00d6eb22c346ed5881d8976cc34a5f627d08541e0282d7dd800052faf1c82428bbea18c2889f21a6bdb2e2621ed8c289401f9d4f6d479d1fce8cb6521ca6eb8a

    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\za822388.exe

      Filesize

      969KB

      MD5

      6a57476cf838f2ac33b753cee96fd224

      SHA1

      8974d6451384c86318d5aff6c3191c7b28827dd2

      SHA256

      26b8c3ca8a995bbda9997993e07559dd995b075f75a43b914b1d63cd05be40e9

      SHA512

      00d6eb22c346ed5881d8976cc34a5f627d08541e0282d7dd800052faf1c82428bbea18c2889f21a6bdb2e2621ed8c289401f9d4f6d479d1fce8cb6521ca6eb8a

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xdNqk42.exe

      Filesize

      366KB

      MD5

      f99f3b030f1df50e0f912044f898e819

      SHA1

      3f1353eb93b2dc56fd4674c3b93783d181160fae

      SHA256

      fe79f747721bba920adaa6f24b44b56a9e36e4e37fe172edb5f88f2b4a6f8935

      SHA512

      cb23c53cb8fc6871b14ba111c1438e000b7336fbdb44c61767ee751b5bfe09b24b34b965c345cb76d21525727c0110d8d2989edfde310e00df8790bb7c488991

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xdNqk42.exe

      Filesize

      366KB

      MD5

      f99f3b030f1df50e0f912044f898e819

      SHA1

      3f1353eb93b2dc56fd4674c3b93783d181160fae

      SHA256

      fe79f747721bba920adaa6f24b44b56a9e36e4e37fe172edb5f88f2b4a6f8935

      SHA512

      cb23c53cb8fc6871b14ba111c1438e000b7336fbdb44c61767ee751b5bfe09b24b34b965c345cb76d21525727c0110d8d2989edfde310e00df8790bb7c488991

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za927548.exe

      Filesize

      602KB

      MD5

      2ca85ba118b4fbb37c0e1045b2dda336

      SHA1

      d3049270f5b4d70bf637549bf38887f16e43e926

      SHA256

      8acb22d267705f573bc14dd5fbd27c7a508826d919e861717f01236e9b4ceaf2

      SHA512

      e7a668eaf845e66f9f9ac250fe1e638b05f7fdd29f26db5ab703d6a99beed0684b74b06691038a17ab69a6d9a3f13c5f2702dade51d076400fc192ff2644c321

    • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\za927548.exe

      Filesize

      602KB

      MD5

      2ca85ba118b4fbb37c0e1045b2dda336

      SHA1

      d3049270f5b4d70bf637549bf38887f16e43e926

      SHA256

      8acb22d267705f573bc14dd5fbd27c7a508826d919e861717f01236e9b4ceaf2

      SHA512

      e7a668eaf845e66f9f9ac250fe1e638b05f7fdd29f26db5ab703d6a99beed0684b74b06691038a17ab69a6d9a3f13c5f2702dade51d076400fc192ff2644c321

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w24RT54.exe

      Filesize

      229KB

      MD5

      3308051ded87b1863a8d92925202c4b3

      SHA1

      7834ddc23e7976b07118fb580ae38234466dbdfb

      SHA256

      13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

      SHA512

      f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w24RT54.exe

      Filesize

      229KB

      MD5

      3308051ded87b1863a8d92925202c4b3

      SHA1

      7834ddc23e7976b07118fb580ae38234466dbdfb

      SHA256

      13b4b17671c12fd3f9db5491efb7fb389601b57ac7f89fd78638625c1ef201e4

      SHA512

      f8e016a2f9cd7851048811fa2846b1853f175916c32dc593e0c469614e87e4f6b07e3dee1f13c662fe9bb6865dc67837a1ab8036e238202e9353e3120f633ddc

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za852115.exe

      Filesize

      419KB

      MD5

      469bf680bf8cd814ec54f9d748d40013

      SHA1

      a0b1bdb8d45610d3b37df628785ddbc5d426c772

      SHA256

      58de06517fd259a3057f1655a78c806b6dcf34d7abb58c40b83fefb501db125f

      SHA512

      f73fcc810f550b18b90f8373195ac7c912a55431e910f344006fbc76b47f616fc1c1754dae7471275a9269c55fffe84ac82a106e629708986d355dd3a55643f1

    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\za852115.exe

      Filesize

      419KB

      MD5

      469bf680bf8cd814ec54f9d748d40013

      SHA1

      a0b1bdb8d45610d3b37df628785ddbc5d426c772

      SHA256

      58de06517fd259a3057f1655a78c806b6dcf34d7abb58c40b83fefb501db125f

      SHA512

      f73fcc810f550b18b90f8373195ac7c912a55431e910f344006fbc76b47f616fc1c1754dae7471275a9269c55fffe84ac82a106e629708986d355dd3a55643f1

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55984350.exe

      Filesize

      175KB

      MD5

      a165b5f6b0a4bdf808b71de57bf9347d

      SHA1

      39a7b301e819e386c162a47e046fa384bb5ab437

      SHA256

      68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

      SHA512

      3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\55984350.exe

      Filesize

      175KB

      MD5

      a165b5f6b0a4bdf808b71de57bf9347d

      SHA1

      39a7b301e819e386c162a47e046fa384bb5ab437

      SHA256

      68349ed349ed7bbb9a279ac34ea4984206a1a1b3b73587fd1b109d55391af09a

      SHA512

      3dd6ca63a2aecb2a0599f0b918329e75b92eb5259d6986bd8d41cb8ebcf7b965bbd12786929d61743ae8613c2e180078f2eed2835ccb54378cd343c4a048c1a1

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u16371270.exe

      Filesize

      282KB

      MD5

      ca9bd6721bf1b92ded5007f764e02c21

      SHA1

      8b37dd543f72f7477d6a7c0c9aa3efc73aa92af4

      SHA256

      dc555fd3f673f140e755cbed615c544f3fb0e1f93704f06d284fdde49c9ea52c

      SHA512

      6ecb5ca66f048aaa2e1ed90a58dc462ea69a9eefec4862a4d544327f4d8deaab90488b575f3270bc1830e5beab1cb1bbeb56a0e00f827ad39bf9c27911be012c

    • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\u16371270.exe

      Filesize

      282KB

      MD5

      ca9bd6721bf1b92ded5007f764e02c21

      SHA1

      8b37dd543f72f7477d6a7c0c9aa3efc73aa92af4

      SHA256

      dc555fd3f673f140e755cbed615c544f3fb0e1f93704f06d284fdde49c9ea52c

      SHA512

      6ecb5ca66f048aaa2e1ed90a58dc462ea69a9eefec4862a4d544327f4d8deaab90488b575f3270bc1830e5beab1cb1bbeb56a0e00f827ad39bf9c27911be012c

    • memory/2252-228-0x00000000020B0000-0x00000000020DD000-memory.dmp

      Filesize

      180KB

    • memory/2252-229-0x00000000049D0000-0x00000000049E0000-memory.dmp

      Filesize

      64KB

    • memory/2252-230-0x00000000049D0000-0x00000000049E0000-memory.dmp

      Filesize

      64KB

    • memory/2252-231-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/2252-232-0x00000000049D0000-0x00000000049E0000-memory.dmp

      Filesize

      64KB

    • memory/2252-233-0x00000000049D0000-0x00000000049E0000-memory.dmp

      Filesize

      64KB

    • memory/2252-235-0x0000000000400000-0x000000000045A000-memory.dmp

      Filesize

      360KB

    • memory/3168-1062-0x0000000007640000-0x000000000774A000-memory.dmp

      Filesize

      1.0MB

    • memory/3168-616-0x0000000000610000-0x0000000000656000-memory.dmp

      Filesize

      280KB

    • memory/3168-620-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-1057-0x0000000007C60000-0x0000000008278000-memory.dmp

      Filesize

      6.1MB

    • memory/3168-1058-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-1059-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-1060-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-1061-0x0000000004C60000-0x0000000004C72000-memory.dmp

      Filesize

      72KB

    • memory/3168-621-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-1064-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-1065-0x0000000004B10000-0x0000000004B4C000-memory.dmp

      Filesize

      240KB

    • memory/3168-1067-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3168-617-0x0000000004D00000-0x0000000004D10000-memory.dmp

      Filesize

      64KB

    • memory/3544-170-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/3544-194-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/3544-193-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/3544-192-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-190-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-188-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-186-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-184-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-182-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-180-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-178-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-176-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-173-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-174-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/3544-169-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-172-0x0000000004A70000-0x0000000004A80000-memory.dmp

      Filesize

      64KB

    • memory/3544-167-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-165-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-163-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-162-0x00000000023D0000-0x00000000023E3000-memory.dmp

      Filesize

      76KB

    • memory/3544-161-0x0000000004A80000-0x0000000005024000-memory.dmp

      Filesize

      5.6MB