Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2023, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe
Resource
win10v2004-20230703-en
General
-
Target
33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe
-
Size
774KB
-
MD5
598849ad3c499105d680f5aa169f7567
-
SHA1
bbaa93c88d6bbb0f240da884574c72006f2dbe88
-
SHA256
33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b
-
SHA512
fca830bc48ac83ffe94cc70f1fd9bc210f6668e7a5218210c135eb0881f34ba673287843a6ae0b739bfa5ce545a5d2ae9c7dab8b53e38d9295f1d764edc92696
-
SSDEEP
24576:myw7mmNEz3IxeaHPKnEz+4bNquwV8XKw08+AjDl:1omWED0vKnEz+4bNrwn8
Malware Config
Extracted
amadey
S-%lu-
77.91.68.18/nice/index.php
3.87/nice/index.php
Extracted
redline
jonka
77.91.124.73:19071
-
auth_value
c95bc30cd252fa6dff2a19fd78bfab4e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Executes dropped EXE 8 IoCs
pid Process 3396 x1706888.exe 1820 x3760510.exe 4696 g5263452.exe 3180 saves.exe 3588 i7370938.exe 2228 saves.exe 2888 saves.exe 1300 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 2928 rundll32.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" x1706888.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" x3760510.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4912 schtasks.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2660 wrote to memory of 3396 2660 33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe 83 PID 2660 wrote to memory of 3396 2660 33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe 83 PID 2660 wrote to memory of 3396 2660 33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe 83 PID 3396 wrote to memory of 1820 3396 x1706888.exe 84 PID 3396 wrote to memory of 1820 3396 x1706888.exe 84 PID 3396 wrote to memory of 1820 3396 x1706888.exe 84 PID 1820 wrote to memory of 4696 1820 x3760510.exe 85 PID 1820 wrote to memory of 4696 1820 x3760510.exe 85 PID 1820 wrote to memory of 4696 1820 x3760510.exe 85 PID 4696 wrote to memory of 3180 4696 g5263452.exe 86 PID 4696 wrote to memory of 3180 4696 g5263452.exe 86 PID 4696 wrote to memory of 3180 4696 g5263452.exe 86 PID 1820 wrote to memory of 3588 1820 x3760510.exe 87 PID 1820 wrote to memory of 3588 1820 x3760510.exe 87 PID 1820 wrote to memory of 3588 1820 x3760510.exe 87 PID 3180 wrote to memory of 4912 3180 saves.exe 88 PID 3180 wrote to memory of 4912 3180 saves.exe 88 PID 3180 wrote to memory of 4912 3180 saves.exe 88 PID 3180 wrote to memory of 3360 3180 saves.exe 90 PID 3180 wrote to memory of 3360 3180 saves.exe 90 PID 3180 wrote to memory of 3360 3180 saves.exe 90 PID 3360 wrote to memory of 1912 3360 cmd.exe 92 PID 3360 wrote to memory of 1912 3360 cmd.exe 92 PID 3360 wrote to memory of 1912 3360 cmd.exe 92 PID 3360 wrote to memory of 3132 3360 cmd.exe 93 PID 3360 wrote to memory of 3132 3360 cmd.exe 93 PID 3360 wrote to memory of 3132 3360 cmd.exe 93 PID 3360 wrote to memory of 3080 3360 cmd.exe 94 PID 3360 wrote to memory of 3080 3360 cmd.exe 94 PID 3360 wrote to memory of 3080 3360 cmd.exe 94 PID 3360 wrote to memory of 3248 3360 cmd.exe 95 PID 3360 wrote to memory of 3248 3360 cmd.exe 95 PID 3360 wrote to memory of 3248 3360 cmd.exe 95 PID 3360 wrote to memory of 4292 3360 cmd.exe 96 PID 3360 wrote to memory of 4292 3360 cmd.exe 96 PID 3360 wrote to memory of 4292 3360 cmd.exe 96 PID 3360 wrote to memory of 3780 3360 cmd.exe 97 PID 3360 wrote to memory of 3780 3360 cmd.exe 97 PID 3360 wrote to memory of 3780 3360 cmd.exe 97 PID 3180 wrote to memory of 2928 3180 saves.exe 107 PID 3180 wrote to memory of 2928 3180 saves.exe 107 PID 3180 wrote to memory of 2928 3180 saves.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe"C:\Users\Admin\AppData\Local\Temp\33ca8559428948c8807d92e92d833e6be360ccf985811fbea56ffe21361e5f0b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1706888.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1706888.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3760510.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3760510.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5263452.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5263452.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F6⤵
- Creates scheduled task(s)
PID:4912
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1912
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"7⤵PID:3132
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E7⤵PID:3080
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3248
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"7⤵PID:4292
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E7⤵PID:3780
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2928
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i7370938.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i7370938.exe4⤵
- Executes dropped EXE
PID:3588
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2228
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:2888
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
497KB
MD537e4641dd8c5267f6d558a557ae16c70
SHA16ac6f538cab9888b5744790fd55e0f70375642f0
SHA25668333c7be1b2648941e1900509c1978d5cf48f0bb089fe02bc11bf3c6ff73e25
SHA512d1d3113fa37bbc87b1177281809f010ba9518c1fc9c5f6322ff32d9f41458bddeefb5b568b3be1a4cfd403ce0c85734730e7e60bbf9870c2965243c87ffb7b15
-
Filesize
497KB
MD537e4641dd8c5267f6d558a557ae16c70
SHA16ac6f538cab9888b5744790fd55e0f70375642f0
SHA25668333c7be1b2648941e1900509c1978d5cf48f0bb089fe02bc11bf3c6ff73e25
SHA512d1d3113fa37bbc87b1177281809f010ba9518c1fc9c5f6322ff32d9f41458bddeefb5b568b3be1a4cfd403ce0c85734730e7e60bbf9870c2965243c87ffb7b15
-
Filesize
331KB
MD5e7d97b9fc192380db7e559c9e51adafb
SHA1303555b70af39e4d5bdbede7a4c407a9d7f3e7db
SHA256c63dd257d950d6882ef34bdacbf81c9356b6054c3384d4c3f4a84161cfa93f38
SHA5122fb5ecfdda0ef763a8ad59cd0cd685a513ad7059af88fe99e007023d6f36603da8477b61dd83261c44c17310220be2a68dfcfae82fcffddbf6ff7c86976c4405
-
Filesize
331KB
MD5e7d97b9fc192380db7e559c9e51adafb
SHA1303555b70af39e4d5bdbede7a4c407a9d7f3e7db
SHA256c63dd257d950d6882ef34bdacbf81c9356b6054c3384d4c3f4a84161cfa93f38
SHA5122fb5ecfdda0ef763a8ad59cd0cd685a513ad7059af88fe99e007023d6f36603da8477b61dd83261c44c17310220be2a68dfcfae82fcffddbf6ff7c86976c4405
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
174KB
MD5bed79bf47a1f48abe00965706d8c14d2
SHA1dc5d7aee5066cf7723f0490ac2d200006942d52b
SHA2564636df7f4cce2df69ea12b8c057c9a57fb61bbef9871196d853eb3169291c4a2
SHA5120d9dba787c90bbc143ddba13d0719c57f861b042e4eb2b34ff22f36f0ca80f08fc5c5307499d76e2e6a0df1a748438777c5af5e3a6416e4c0f2348ea13ca21c9
-
Filesize
174KB
MD5bed79bf47a1f48abe00965706d8c14d2
SHA1dc5d7aee5066cf7723f0490ac2d200006942d52b
SHA2564636df7f4cce2df69ea12b8c057c9a57fb61bbef9871196d853eb3169291c4a2
SHA5120d9dba787c90bbc143ddba13d0719c57f861b042e4eb2b34ff22f36f0ca80f08fc5c5307499d76e2e6a0df1a748438777c5af5e3a6416e4c0f2348ea13ca21c9
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
313KB
MD569b27fe3308bebb904ae9c80c0745ae3
SHA153ab89c8f91f8ece4916747db74b4d22ef6cef95
SHA2561993d56acb6625090a7cb3bf282e4a887a91bd90431df1bc88a873abf71e7c7b
SHA512e4f6d3a2dee21fd4f225df212a64d4fbdb027d3e4e1f00c6c0312dfb7dfa18309ba2b2cdf7f5f8f38bf15ee66374354cf5a26cf4896e3551d47339bf9174fb70
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7