Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 22:32
Static task
static1
Behavioral task
behavioral1
Sample
989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe
Resource
win10v2004-20230703-en
General
-
Target
989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe
-
Size
756KB
-
MD5
eaf25949160b075bbd504093eb1755d4
-
SHA1
0887af29081777af43fdf94b43e2f90c8179ac68
-
SHA256
989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379
-
SHA512
95c7acc07128205f8e8ce0c0ba1243b37c3b6af4cebe88698949b0d23aea5dd73a41e420ff8f05eefd8e272c5b7c2ee697cd3c2ed6e5cf5714b36409adfc4bc3
-
SSDEEP
12288:ZMrly90jla4eQ4+hOeK68Iu/LwnpaZIoD8yK3KsO7PjzR7Z2bm:MyGs4eQOe+zo0ZpTt/7LzRZ
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
jonka
77.91.124.73:19071
-
auth_value
c95bc30cd252fa6dff2a19fd78bfab4e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 9 IoCs
pid Process 5016 y4503176.exe 4400 y6753312.exe 4388 m0537124.exe 3648 n6991928.exe 2192 saves.exe 1988 o0754786.exe 3224 saves.exe 1032 saves.exe 3180 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 2292 rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y4503176.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y6753312.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4892 schtasks.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4780 wrote to memory of 5016 4780 989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe 82 PID 4780 wrote to memory of 5016 4780 989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe 82 PID 4780 wrote to memory of 5016 4780 989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe 82 PID 5016 wrote to memory of 4400 5016 y4503176.exe 83 PID 5016 wrote to memory of 4400 5016 y4503176.exe 83 PID 5016 wrote to memory of 4400 5016 y4503176.exe 83 PID 4400 wrote to memory of 4388 4400 y6753312.exe 84 PID 4400 wrote to memory of 4388 4400 y6753312.exe 84 PID 4400 wrote to memory of 4388 4400 y6753312.exe 84 PID 4400 wrote to memory of 3648 4400 y6753312.exe 85 PID 4400 wrote to memory of 3648 4400 y6753312.exe 85 PID 4400 wrote to memory of 3648 4400 y6753312.exe 85 PID 3648 wrote to memory of 2192 3648 n6991928.exe 86 PID 3648 wrote to memory of 2192 3648 n6991928.exe 86 PID 3648 wrote to memory of 2192 3648 n6991928.exe 86 PID 5016 wrote to memory of 1988 5016 y4503176.exe 87 PID 5016 wrote to memory of 1988 5016 y4503176.exe 87 PID 5016 wrote to memory of 1988 5016 y4503176.exe 87 PID 2192 wrote to memory of 4892 2192 saves.exe 88 PID 2192 wrote to memory of 4892 2192 saves.exe 88 PID 2192 wrote to memory of 4892 2192 saves.exe 88 PID 2192 wrote to memory of 32 2192 saves.exe 90 PID 2192 wrote to memory of 32 2192 saves.exe 90 PID 2192 wrote to memory of 32 2192 saves.exe 90 PID 32 wrote to memory of 2880 32 cmd.exe 92 PID 32 wrote to memory of 2880 32 cmd.exe 92 PID 32 wrote to memory of 2880 32 cmd.exe 92 PID 32 wrote to memory of 3144 32 cmd.exe 93 PID 32 wrote to memory of 3144 32 cmd.exe 93 PID 32 wrote to memory of 3144 32 cmd.exe 93 PID 32 wrote to memory of 3156 32 cmd.exe 94 PID 32 wrote to memory of 3156 32 cmd.exe 94 PID 32 wrote to memory of 3156 32 cmd.exe 94 PID 32 wrote to memory of 4620 32 cmd.exe 95 PID 32 wrote to memory of 4620 32 cmd.exe 95 PID 32 wrote to memory of 4620 32 cmd.exe 95 PID 32 wrote to memory of 4692 32 cmd.exe 96 PID 32 wrote to memory of 4692 32 cmd.exe 96 PID 32 wrote to memory of 4692 32 cmd.exe 96 PID 32 wrote to memory of 3164 32 cmd.exe 97 PID 32 wrote to memory of 3164 32 cmd.exe 97 PID 32 wrote to memory of 3164 32 cmd.exe 97 PID 2192 wrote to memory of 2292 2192 saves.exe 107 PID 2192 wrote to memory of 2292 2192 saves.exe 107 PID 2192 wrote to memory of 2292 2192 saves.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe"C:\Users\Admin\AppData\Local\Temp\989982e6d4c4131dfec86f068e66259cc187ff02974bfdc4df96dd9a0ddb8379.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4503176.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4503176.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6753312.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y6753312.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0537124.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0537124.exe4⤵
- Executes dropped EXE
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6991928.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6991928.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F6⤵
- Creates scheduled task(s)
PID:4892
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:32 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2880
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"7⤵PID:3144
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E7⤵PID:3156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4620
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"7⤵PID:4692
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E7⤵PID:3164
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2292
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0754786.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0754786.exe3⤵
- Executes dropped EXE
PID:1988
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3224
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1032
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:3180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
476KB
MD5d0cc380d57625c94c59746d3220740a2
SHA138b2b7aef991957718e297ca5d6dc8a582ad3e56
SHA2560fc4a0a9da3f2bdf00e91ce7f74aab98163e1161c19b63682169aef7cd527d55
SHA5121edb466dce38d1d392ff3c8faa78bbce39e063145ee1d6b9096de59a0fcd00f7bc5236119b2f49dbd22ecf4ac65e82c4615e31a6102f1a88f084406097d0de66
-
Filesize
476KB
MD5d0cc380d57625c94c59746d3220740a2
SHA138b2b7aef991957718e297ca5d6dc8a582ad3e56
SHA2560fc4a0a9da3f2bdf00e91ce7f74aab98163e1161c19b63682169aef7cd527d55
SHA5121edb466dce38d1d392ff3c8faa78bbce39e063145ee1d6b9096de59a0fcd00f7bc5236119b2f49dbd22ecf4ac65e82c4615e31a6102f1a88f084406097d0de66
-
Filesize
174KB
MD555475e32745bee921a2843897f87b5fe
SHA1905dadaf4c54e3cb5e64fddf364b6b03038ad057
SHA256e1c406b1fcc48e936df4a8a70d582a0caae87094c0b3500e39d6d036aff822a2
SHA512017d38aaae2ab98f788e785312a22be67dd7139c96991737afc062b523ed2a28feca6bd53fa330fcb18f8e8699b2d3b53d89cc19cbdc037bc4925de9f67ad28e
-
Filesize
174KB
MD555475e32745bee921a2843897f87b5fe
SHA1905dadaf4c54e3cb5e64fddf364b6b03038ad057
SHA256e1c406b1fcc48e936df4a8a70d582a0caae87094c0b3500e39d6d036aff822a2
SHA512017d38aaae2ab98f788e785312a22be67dd7139c96991737afc062b523ed2a28feca6bd53fa330fcb18f8e8699b2d3b53d89cc19cbdc037bc4925de9f67ad28e
-
Filesize
320KB
MD5e72057b66cc032bc30450e524e29b901
SHA1fd1c0f42affc97f96989f60baba399ffeecfd7f5
SHA2560d644817b508599be5a3f76fdfa93ad2bc69ba3c80b2eb38bb438c5dd6ab5812
SHA5123cbda0c6180945f4520b5fb9368c0187f24ad5a66cf07ae039f33de9afdb96bb5594da8bde24feeff7b41d0c8a660efea4c9182325cbd1930f424fd299f6a177
-
Filesize
320KB
MD5e72057b66cc032bc30450e524e29b901
SHA1fd1c0f42affc97f96989f60baba399ffeecfd7f5
SHA2560d644817b508599be5a3f76fdfa93ad2bc69ba3c80b2eb38bb438c5dd6ab5812
SHA5123cbda0c6180945f4520b5fb9368c0187f24ad5a66cf07ae039f33de9afdb96bb5594da8bde24feeff7b41d0c8a660efea4c9182325cbd1930f424fd299f6a177
-
Filesize
140KB
MD58d5f17011509ea2a6f1334430c6fa664
SHA1dcae78973384c3b600af0f4c045b61cf62310907
SHA256566508cf56b529db924eeb1f99e33d7281088ec66655242fd5136ce4a25892ea
SHA5126e8f05ae41a27e865281819981aca8f5d2af9d4f86c089ca413db88bb4811504f19c7a2ed87698c91b8ba77aeb3752172064757591efed097f4ff250d18e27da
-
Filesize
140KB
MD58d5f17011509ea2a6f1334430c6fa664
SHA1dcae78973384c3b600af0f4c045b61cf62310907
SHA256566508cf56b529db924eeb1f99e33d7281088ec66655242fd5136ce4a25892ea
SHA5126e8f05ae41a27e865281819981aca8f5d2af9d4f86c089ca413db88bb4811504f19c7a2ed87698c91b8ba77aeb3752172064757591efed097f4ff250d18e27da
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7