Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2023, 00:17

General

  • Target

    eda3f3152248552015622e64cf6b86d67e3e3b758fb1e5dd58cc0b6651c5954d.exe

  • Size

    576KB

  • MD5

    c7761893c717c21a4fe77eabe6e1c175

  • SHA1

    4ba52ec0a4aa81d3634daf6c361b2a204fa6fe3c

  • SHA256

    eda3f3152248552015622e64cf6b86d67e3e3b758fb1e5dd58cc0b6651c5954d

  • SHA512

    5658ddadee96fb85adc5d854f24af969902ddf5d87ee56c9c345362e1ca5107c429715b023cc7abfb0a98fa8c07034442a4f680db55fa1a92bac54e47e15ee7c

  • SSDEEP

    12288:LMroy907OtjbVd0hxpMVcBtaiqaw0K1OVwljMI:zyrtgzmV4wa41Oy

Malware Config

Extracted

Family

redline

Botnet

dana

C2

83.97.73.130:19061

Attributes
  • auth_value

    da2d1691db653e49676d799e1eae2673

Extracted

Family

amadey

Version

3.84

C2

77.91.68.63/doma/net/index.php

Extracted

Family

redline

Botnet

joker

C2

83.97.73.130:19061

Attributes
  • auth_value

    a98d303cc28bb3b32a23c59214ae3bc0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eda3f3152248552015622e64cf6b86d67e3e3b758fb1e5dd58cc0b6651c5954d.exe
    "C:\Users\Admin\AppData\Local\Temp\eda3f3152248552015622e64cf6b86d67e3e3b758fb1e5dd58cc0b6651c5954d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3944
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9497993.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9497993.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7772363.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7772363.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:824
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6763705.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6763705.exe
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:440
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1655714.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1655714.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4556
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4064990.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4064990.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
          "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:5028
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rugen.exe /TR "C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:2560
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rugen.exe" /P "Admin:N"&&CACLS "rugen.exe" /P "Admin:R" /E&&echo Y|CACLS "..\200f691d32" /P "Admin:N"&&CACLS "..\200f691d32" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3856
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:1472
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "rugen.exe" /P "Admin:N"
                6⤵
                  PID:4548
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "rugen.exe" /P "Admin:R" /E
                  6⤵
                    PID:5096
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:2344
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\200f691d32" /P "Admin:N"
                      6⤵
                        PID:4744
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\200f691d32" /P "Admin:R" /E
                        6⤵
                          PID:2308
                      • C:\Windows\SysWOW64\rundll32.exe
                        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                        5⤵
                        • Loads dropped DLL
                        PID:4812
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5663531.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5663531.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3484
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:2416
              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe
                1⤵
                • Executes dropped EXE
                PID:4980

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\200f691d32\rugen.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5663531.exe

                Filesize

                255KB

                MD5

                e372d596939e23d42562e25606504a3d

                SHA1

                814bd8ab81701804f18583cfcc494ec0a8842c4e

                SHA256

                2a65767c7adcd91fefbfd167e0b1d2e259fa044dd962739a31b18f5fcf1d006d

                SHA512

                04cb1add2fb7364a441252da441da4f4341f040e4a955f42a23e236f301e824026c5a8f6320121dbfc2e831595de83b775594d46e043c8fa721d219f47582407

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i5663531.exe

                Filesize

                255KB

                MD5

                e372d596939e23d42562e25606504a3d

                SHA1

                814bd8ab81701804f18583cfcc494ec0a8842c4e

                SHA256

                2a65767c7adcd91fefbfd167e0b1d2e259fa044dd962739a31b18f5fcf1d006d

                SHA512

                04cb1add2fb7364a441252da441da4f4341f040e4a955f42a23e236f301e824026c5a8f6320121dbfc2e831595de83b775594d46e043c8fa721d219f47582407

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9497993.exe

                Filesize

                377KB

                MD5

                7b958b8ba77471a260a7f54ad2762d6c

                SHA1

                7941e3d5d56d171e213fa4d995cc6c41aa3de2da

                SHA256

                9bb35d1deea337df6cdc43b8a64eb82a84438f14adf6524c429bd68794c3d2f5

                SHA512

                5a1e3083a1e72ed5d4fe7096dd11107a64e5d99992a8ac8c223adfa11be5152e5f39c4f24f2df169acc55dc643a8914fb50531e8a0ca386a2d7acb575952937f

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9497993.exe

                Filesize

                377KB

                MD5

                7b958b8ba77471a260a7f54ad2762d6c

                SHA1

                7941e3d5d56d171e213fa4d995cc6c41aa3de2da

                SHA256

                9bb35d1deea337df6cdc43b8a64eb82a84438f14adf6524c429bd68794c3d2f5

                SHA512

                5a1e3083a1e72ed5d4fe7096dd11107a64e5d99992a8ac8c223adfa11be5152e5f39c4f24f2df169acc55dc643a8914fb50531e8a0ca386a2d7acb575952937f

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4064990.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4064990.exe

                Filesize

                205KB

                MD5

                0d0704c85d6f1c69ce867df093770905

                SHA1

                5f8c93ec0d0e0b3b6d9daf518bc65b5d1049e7b2

                SHA256

                030253a9f0fc91ea46bd62c299e8f4bf4de8b180521de75dd8ccb5f86a5ef1ed

                SHA512

                3e32cd6e69de26d5daa98cd894f3996983b1c13d554fe31683ef18c8d85486b06f96e21c79f75bf0253be638629f4b4673488713bd92111d9093fb52a6d0a921

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7772363.exe

                Filesize

                206KB

                MD5

                12abc2683f7d8f0df5b64f5d5bcd703b

                SHA1

                76e9fefeaad0fdebef5397547db5d25be1972644

                SHA256

                6a3143c591bc18e08a4c333c791226503f1b70964681cf17913089a3dd17382e

                SHA512

                2def1dc92df249651fe0520e41deeb769dfe3f8c0d82f341d49d04c89ad9e039cc3c1c8cd5d6cd275665b1f1de158f347b7f011b0645c064de4adcbfa2189e5b

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7772363.exe

                Filesize

                206KB

                MD5

                12abc2683f7d8f0df5b64f5d5bcd703b

                SHA1

                76e9fefeaad0fdebef5397547db5d25be1972644

                SHA256

                6a3143c591bc18e08a4c333c791226503f1b70964681cf17913089a3dd17382e

                SHA512

                2def1dc92df249651fe0520e41deeb769dfe3f8c0d82f341d49d04c89ad9e039cc3c1c8cd5d6cd275665b1f1de158f347b7f011b0645c064de4adcbfa2189e5b

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6763705.exe

                Filesize

                173KB

                MD5

                967e9b409d0e7e768b623ae82c21df7a

                SHA1

                089f37b98bb91b0bc61ee0f5f9a479f938b9119a

                SHA256

                8f1735e8cf1e50f30b6626c98dec8cf1e0a95b05638b252b6c839d2003f0116d

                SHA512

                877e9917d4a9cf993a7a2db367249ac0092d995b4aa90d6f9d605dba77de43ebfe3e20dfeeba149c39ecab76a4722fcac62382933ce770e4fc7de16b7d6035b6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\f6763705.exe

                Filesize

                173KB

                MD5

                967e9b409d0e7e768b623ae82c21df7a

                SHA1

                089f37b98bb91b0bc61ee0f5f9a479f938b9119a

                SHA256

                8f1735e8cf1e50f30b6626c98dec8cf1e0a95b05638b252b6c839d2003f0116d

                SHA512

                877e9917d4a9cf993a7a2db367249ac0092d995b4aa90d6f9d605dba77de43ebfe3e20dfeeba149c39ecab76a4722fcac62382933ce770e4fc7de16b7d6035b6

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1655714.exe

                Filesize

                11KB

                MD5

                7b72bfb93cf6f2fbe0c0a016c7e0de37

                SHA1

                e018e8f8e149a2df4e18b58a58fc0ebb91f54e27

                SHA256

                1897b9b842ac4d78fa2312e4349fd3011980b05464d9ebca5c45a2103e383e80

                SHA512

                4e8ec05a9137b898cf005608a23a72ab48e79d360c744d5678453e88a2f3ab33aca6b72dbbc904301f68ee8c8ee5819d6f68b4f90b48684590c909a33f46cd91

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g1655714.exe

                Filesize

                11KB

                MD5

                7b72bfb93cf6f2fbe0c0a016c7e0de37

                SHA1

                e018e8f8e149a2df4e18b58a58fc0ebb91f54e27

                SHA256

                1897b9b842ac4d78fa2312e4349fd3011980b05464d9ebca5c45a2103e383e80

                SHA512

                4e8ec05a9137b898cf005608a23a72ab48e79d360c744d5678453e88a2f3ab33aca6b72dbbc904301f68ee8c8ee5819d6f68b4f90b48684590c909a33f46cd91

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                83fc14fb36516facb19e0e96286f7f48

                SHA1

                40082ca06de4c377585cd164fb521bacadb673da

                SHA256

                08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e

                SHA512

                ba60d28195b8ce60fd6f4cd57919a190c910af3e71e2858ed266a958314798ed51323d3c870c572d2fb873aae34387afa0dd8c7624e5f5cf51e586aafb76efcf

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                162B

                MD5

                1b7c22a214949975556626d7217e9a39

                SHA1

                d01c97e2944166ed23e47e4a62ff471ab8fa031f

                SHA256

                340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

                SHA512

                ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

              • memory/440-157-0x000000000A4B0000-0x000000000A4C2000-memory.dmp

                Filesize

                72KB

              • memory/440-158-0x000000000A510000-0x000000000A54C000-memory.dmp

                Filesize

                240KB

              • memory/440-167-0x000000000BD40000-0x000000000BD90000-memory.dmp

                Filesize

                320KB

              • memory/440-166-0x0000000005040000-0x0000000005050000-memory.dmp

                Filesize

                64KB

              • memory/440-165-0x000000000C540000-0x000000000CA6C000-memory.dmp

                Filesize

                5.2MB

              • memory/440-164-0x000000000BE40000-0x000000000C002000-memory.dmp

                Filesize

                1.8MB

              • memory/440-163-0x000000000B110000-0x000000000B176000-memory.dmp

                Filesize

                408KB

              • memory/440-162-0x000000000B5C0000-0x000000000BB64000-memory.dmp

                Filesize

                5.6MB

              • memory/440-161-0x000000000A940000-0x000000000A9D2000-memory.dmp

                Filesize

                584KB

              • memory/440-154-0x00000000005F0000-0x0000000000620000-memory.dmp

                Filesize

                192KB

              • memory/440-155-0x000000000A9F0000-0x000000000B008000-memory.dmp

                Filesize

                6.1MB

              • memory/440-160-0x000000000A820000-0x000000000A896000-memory.dmp

                Filesize

                472KB

              • memory/440-159-0x0000000005040000-0x0000000005050000-memory.dmp

                Filesize

                64KB

              • memory/440-156-0x000000000A570000-0x000000000A67A000-memory.dmp

                Filesize

                1.0MB

              • memory/3484-194-0x0000000004A90000-0x0000000004AA0000-memory.dmp

                Filesize

                64KB

              • memory/3484-190-0x0000000000640000-0x0000000000670000-memory.dmp

                Filesize

                192KB

              • memory/4556-172-0x0000000000540000-0x000000000054A000-memory.dmp

                Filesize

                40KB