Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    22/08/2023, 08:25

General

  • Target

    948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe

  • Size

    591KB

  • MD5

    e008139c1ea96bf93210e24a15736dcb

  • SHA1

    49e7f45542c40c686223cb3cb6081a4a71394970

  • SHA256

    948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d

  • SHA512

    04f201142a50d71e97a593cf17d72ca58ecae166f949455983a02e07b0f5bf5426a3e78b01e15006980abccabc3833d9e7d7ba41c2067f59647cbf411114ae36

  • SSDEEP

    12288:2MrTy90nHDBqPDBL0PPCkNtVHzQR7TaXOlR60hgGwBod:1y+jBqrSBdz4mXOl6G1

Malware Config

Extracted

Family

amadey

Version

S-%lu-

C2

77.91.68.18/nice/index.php

3.87/nice/index.php

Extracted

Family

redline

Botnet

piter

C2

77.91.124.73:19071

Attributes
  • auth_value

    7f92ff466423bb35edbfbc22f78b0bb9

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe
    "C:\Users\Admin\AppData\Local\Temp\948ba1ae71617fd4888e69562900a7245478531c3e62df438726031a0d3d706d.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4192
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1353814.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1353814.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:168
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1445275.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1445275.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:164
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0696587.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0696587.exe
          4⤵
          • Executes dropped EXE
          PID:2680
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6147469.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6147469.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4968
          • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
            "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4508
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:4492
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1372
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:1508
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "saves.exe" /P "Admin:N"
                  7⤵
                    PID:3388
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:R" /E
                    7⤵
                      PID:4136
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4948
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\b40d11255d" /P "Admin:N"
                        7⤵
                          PID:4624
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:R" /E
                          7⤵
                            PID:2336
                        • C:\Windows\SysWOW64\rundll32.exe
                          "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                          6⤵
                          • Loads dropped DLL
                          PID:4408
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0833682.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0833682.exe
                    3⤵
                    • Executes dropped EXE
                    PID:5096
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4436
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:3820

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1353814.exe

                Filesize

                475KB

                MD5

                c25cca3ef87f295b6c2e7c325249e7ab

                SHA1

                4d0eb4e66f13fef823f2043699466c1bc16bbc1c

                SHA256

                799b85d426953f94a60dc552fa250f27d73dc3e73992e4225bd5206d71443917

                SHA512

                36fa9fd9f8b42efdd74cf6c9dbdbbe06487d9bc70f4342d7fd7747522d61340ffcf4adde954c8ddb91c62c2ac6cea4cee65e65cc5fee9018969935ce3ee48704

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1353814.exe

                Filesize

                475KB

                MD5

                c25cca3ef87f295b6c2e7c325249e7ab

                SHA1

                4d0eb4e66f13fef823f2043699466c1bc16bbc1c

                SHA256

                799b85d426953f94a60dc552fa250f27d73dc3e73992e4225bd5206d71443917

                SHA512

                36fa9fd9f8b42efdd74cf6c9dbdbbe06487d9bc70f4342d7fd7747522d61340ffcf4adde954c8ddb91c62c2ac6cea4cee65e65cc5fee9018969935ce3ee48704

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0833682.exe

                Filesize

                174KB

                MD5

                ff5f2dba0f830ac52876f63ae4edf73f

                SHA1

                e39704f2dd77d8a63c4ea6ae2a49428370f3fb84

                SHA256

                f0b378b4d6b139502cbac7595903fcb06e600d1cd9f9c0a730b80d442d46185a

                SHA512

                db952bab7bfce383e61c4ad32af786c1f23f0944a5a668a91f24f4a7e778f70fd9fcf26f8f74eecc8f39984eb78ad994b66c422db155e36b33b520f7d9e44753

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\o0833682.exe

                Filesize

                174KB

                MD5

                ff5f2dba0f830ac52876f63ae4edf73f

                SHA1

                e39704f2dd77d8a63c4ea6ae2a49428370f3fb84

                SHA256

                f0b378b4d6b139502cbac7595903fcb06e600d1cd9f9c0a730b80d442d46185a

                SHA512

                db952bab7bfce383e61c4ad32af786c1f23f0944a5a668a91f24f4a7e778f70fd9fcf26f8f74eecc8f39984eb78ad994b66c422db155e36b33b520f7d9e44753

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1445275.exe

                Filesize

                320KB

                MD5

                d58e131e154db359cd4d95a09fbfc004

                SHA1

                215284f9b27f06ac9a0de5996b0cd6839bca4b19

                SHA256

                5aa94f1ccdfc36128e4baeb0d28154416ab9a2af2261c3d114a818c4e26487b2

                SHA512

                37ab71393663946bf20f94d14249089c55c6386314c9125626ffc95c24a48386ee1fffd617fba155385f949d918768071ea4b2bec34107aa098fbf2c1959db66

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1445275.exe

                Filesize

                320KB

                MD5

                d58e131e154db359cd4d95a09fbfc004

                SHA1

                215284f9b27f06ac9a0de5996b0cd6839bca4b19

                SHA256

                5aa94f1ccdfc36128e4baeb0d28154416ab9a2af2261c3d114a818c4e26487b2

                SHA512

                37ab71393663946bf20f94d14249089c55c6386314c9125626ffc95c24a48386ee1fffd617fba155385f949d918768071ea4b2bec34107aa098fbf2c1959db66

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0696587.exe

                Filesize

                140KB

                MD5

                535a2ecc3ff2bc180b9306ba5d92a4dc

                SHA1

                eba928e198e32616af7c80669b4a8a65d363fbd7

                SHA256

                c04a2b6712cdbac32e1429f3b09a8c9fc9d50cbeb295b36e7b7b2c70d958e765

                SHA512

                23ccc45fe53dff5bffe5f2ab65d22756ca270736d3f36bfb027ca214ac990d451f8afc503493aad1c745c0811bb3d70b990ea50e01dd8e7cf9b25dd66ca007e8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m0696587.exe

                Filesize

                140KB

                MD5

                535a2ecc3ff2bc180b9306ba5d92a4dc

                SHA1

                eba928e198e32616af7c80669b4a8a65d363fbd7

                SHA256

                c04a2b6712cdbac32e1429f3b09a8c9fc9d50cbeb295b36e7b7b2c70d958e765

                SHA512

                23ccc45fe53dff5bffe5f2ab65d22756ca270736d3f36bfb027ca214ac990d451f8afc503493aad1c745c0811bb3d70b990ea50e01dd8e7cf9b25dd66ca007e8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6147469.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6147469.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                315KB

                MD5

                236b3b00cabd6dff003fa9d47e22aa4a

                SHA1

                fe9bb3795796ed7b61ccc29e4859e2f41acb8583

                SHA256

                a81250792b11b68c2a7c30451e60fc0e38611d2d726614b6683c0d69a1c525e7

                SHA512

                dd8816e4780e37011f3d699b583b3717e7e91abf6f3a7aefdd7b95e0083b0ca2c17371c0903928e3da1fe746ca10138ea08ee3bd5979a55b594d7babd5cda65e

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • memory/5096-151-0x0000000072D30000-0x000000007341E000-memory.dmp

                Filesize

                6.9MB

              • memory/5096-157-0x000000000AC40000-0x000000000AC8B000-memory.dmp

                Filesize

                300KB

              • memory/5096-158-0x0000000072D30000-0x000000007341E000-memory.dmp

                Filesize

                6.9MB

              • memory/5096-156-0x000000000AC00000-0x000000000AC3E000-memory.dmp

                Filesize

                248KB

              • memory/5096-155-0x000000000ABA0000-0x000000000ABB2000-memory.dmp

                Filesize

                72KB

              • memory/5096-154-0x000000000AC90000-0x000000000AD9A000-memory.dmp

                Filesize

                1.0MB

              • memory/5096-153-0x000000000B190000-0x000000000B796000-memory.dmp

                Filesize

                6.0MB

              • memory/5096-152-0x00000000017D0000-0x00000000017D6000-memory.dmp

                Filesize

                24KB

              • memory/5096-150-0x0000000000E60000-0x0000000000E90000-memory.dmp

                Filesize

                192KB