Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2023, 10:41

General

  • Target

    705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe

  • Size

    703KB

  • MD5

    813ab31bc19323400ab2e83d90088548

  • SHA1

    91395a8db58bcd52f4e9b9ee652ee1b3a044673e

  • SHA256

    705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967

  • SHA512

    78f45e5b8a10d8ff14c8c6ad75c10d05cfa11b50f1e36b530283b5bc6ab90755f8eedd835c7c480eeeee6f111e15ac87cf7d5b957a2f5eb0514cca85c619226d

  • SSDEEP

    12288:MMrdy90BLVct5mYoOf4N3PJWIe9LJTPdpFg/y31s3pK+oSVUvXL:5y2dHOA4LJTPdo/0wpxoSVaXL

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

rota

C2

77.91.124.73:19071

Attributes
  • auth_value

    320c7daa59eb9b82e20a15162392a756

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe
    "C:\Users\Admin\AppData\Local\Temp\705f7478dd00fa98e0292bf9b755ff7e2a30a9b34596b007f65eec1948ed2967.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1876
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1514543.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1514543.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3645679.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3645679.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3776
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0180645.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0180645.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2412
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4327042.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4327042.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:772
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5303881.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5303881.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4536
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:800
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:2532
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4860
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:4792
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:1804
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:4712
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:4796
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:1900
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:1400
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:1948
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6021099.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6021099.exe
                      4⤵
                      • Executes dropped EXE
                      PID:1772
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:2848
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:636
              • C:\Windows\system32\sc.exe
                C:\Windows\system32\sc.exe start wuauserv
                1⤵
                • Launches sc.exe
                PID:216

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1514543.exe

                Filesize

                599KB

                MD5

                4bcf8831b2b71731f301b3321cad85a4

                SHA1

                4a02d0e86a760884140358b122a3871a7f6304b9

                SHA256

                e15f1b72674a327be49162ecbd1a30d6ce19b4e75e7835cf1e094a5963a66faf

                SHA512

                0ab5f6f73af38bdf6a03bc0bbe6fa00d9f3c04e9f881254c3c587839e514c5a1167effc1069594699db90805249c68176b0dbfcee240ea2b856518c45f820175

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1514543.exe

                Filesize

                599KB

                MD5

                4bcf8831b2b71731f301b3321cad85a4

                SHA1

                4a02d0e86a760884140358b122a3871a7f6304b9

                SHA256

                e15f1b72674a327be49162ecbd1a30d6ce19b4e75e7835cf1e094a5963a66faf

                SHA512

                0ab5f6f73af38bdf6a03bc0bbe6fa00d9f3c04e9f881254c3c587839e514c5a1167effc1069594699db90805249c68176b0dbfcee240ea2b856518c45f820175

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3645679.exe

                Filesize

                433KB

                MD5

                8eb152d45ac805d906f9f25c4338155b

                SHA1

                863659a06edeb56eb86e22bc7b354b543dfade7e

                SHA256

                9ea175dacdbfe2d99d3632e277d2ef8b2cc3c1164b40e826fe3e0aa722bc9886

                SHA512

                36f4cd6272a0bebafd554215a73731919be945ab35a2098a182abc9fee4e96eb0a18a6c521edad0942a2e3a4e36b537b62c37ade28b07ba036aa2fc02ba60eb5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3645679.exe

                Filesize

                433KB

                MD5

                8eb152d45ac805d906f9f25c4338155b

                SHA1

                863659a06edeb56eb86e22bc7b354b543dfade7e

                SHA256

                9ea175dacdbfe2d99d3632e277d2ef8b2cc3c1164b40e826fe3e0aa722bc9886

                SHA512

                36f4cd6272a0bebafd554215a73731919be945ab35a2098a182abc9fee4e96eb0a18a6c521edad0942a2e3a4e36b537b62c37ade28b07ba036aa2fc02ba60eb5

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6021099.exe

                Filesize

                174KB

                MD5

                53d5b5e4316f1f3a407969dd56ee6e10

                SHA1

                1d4677dd666b31f0bebf511158570b08812d6e74

                SHA256

                31c255124806c4971c9ecde8a0e9dcf42246a50d356d73360e8c3ba71d034684

                SHA512

                9063e4d39eff536fbd01984a5b29c5fab3e6da07591bc580ed88e9846e641943c924668805cd2c011fbcf4a906abf81e5ab095cf35222e969d450d34b2d43e4f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6021099.exe

                Filesize

                174KB

                MD5

                53d5b5e4316f1f3a407969dd56ee6e10

                SHA1

                1d4677dd666b31f0bebf511158570b08812d6e74

                SHA256

                31c255124806c4971c9ecde8a0e9dcf42246a50d356d73360e8c3ba71d034684

                SHA512

                9063e4d39eff536fbd01984a5b29c5fab3e6da07591bc580ed88e9846e641943c924668805cd2c011fbcf4a906abf81e5ab095cf35222e969d450d34b2d43e4f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0180645.exe

                Filesize

                277KB

                MD5

                60cadc2e0e76e4f4c93c02e9f3c87a05

                SHA1

                4be06232bcc0f29576cbf19179b62d55decfa031

                SHA256

                03df9935890383470e1be5ef60aef7da9b534b3e68333089d34d0d808ec2eaeb

                SHA512

                54faf0c2e1505ffdf5e1b979bba8d8b601f65154cccaa81921ae25c1b87cbac0f4bc738cd12939671a6c8742a47499bc3e88a5523da752a6e7e8110045c08b20

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x0180645.exe

                Filesize

                277KB

                MD5

                60cadc2e0e76e4f4c93c02e9f3c87a05

                SHA1

                4be06232bcc0f29576cbf19179b62d55decfa031

                SHA256

                03df9935890383470e1be5ef60aef7da9b534b3e68333089d34d0d808ec2eaeb

                SHA512

                54faf0c2e1505ffdf5e1b979bba8d8b601f65154cccaa81921ae25c1b87cbac0f4bc738cd12939671a6c8742a47499bc3e88a5523da752a6e7e8110045c08b20

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4327042.exe

                Filesize

                12KB

                MD5

                d9329c67516015f6c60fa97126d87e81

                SHA1

                b487e2e0137c01b60f57a93f34a87934ed5561d8

                SHA256

                1e8215b9c166914d206b8ae74919fae1f776a3f4aaaeaf648f269a484955c6fd

                SHA512

                fef11428be61f386ef2290a6403f77664f9d8c2503631a10c86f2ea547d2ee09f260d5cacf37a75ff972451daba376e78fe4a2ccd0f996cb4cb35f17f3226e53

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4327042.exe

                Filesize

                12KB

                MD5

                d9329c67516015f6c60fa97126d87e81

                SHA1

                b487e2e0137c01b60f57a93f34a87934ed5561d8

                SHA256

                1e8215b9c166914d206b8ae74919fae1f776a3f4aaaeaf648f269a484955c6fd

                SHA512

                fef11428be61f386ef2290a6403f77664f9d8c2503631a10c86f2ea547d2ee09f260d5cacf37a75ff972451daba376e78fe4a2ccd0f996cb4cb35f17f3226e53

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5303881.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5303881.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                316KB

                MD5

                9aaed0adc96706b26a7908d0712cc82e

                SHA1

                d406c7ce0f22c0d1d1e9b70b8623b0b65ce05ccf

                SHA256

                9d6494eb57d1914b02170ad04b616aca1ad476ca8f707d8c1e1f0d89d0b5fbd4

                SHA512

                a10b2f7dbbe6caf74868f16c6734fd4bc4845da4fe310b6efe3c3867bd9625283bc8554fee4dbc2f433ea43a964bbbe0825fb71a5a9771eabbd7ea246879e8e4

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • memory/772-28-0x0000000000240000-0x000000000024A000-memory.dmp

                Filesize

                40KB

              • memory/772-31-0x00007FF9F5160000-0x00007FF9F5C21000-memory.dmp

                Filesize

                10.8MB

              • memory/772-29-0x00007FF9F5160000-0x00007FF9F5C21000-memory.dmp

                Filesize

                10.8MB

              • memory/1772-52-0x000000000A410000-0x000000000A422000-memory.dmp

                Filesize

                72KB

              • memory/1772-51-0x0000000004F90000-0x0000000004FA0000-memory.dmp

                Filesize

                64KB

              • memory/1772-53-0x000000000A470000-0x000000000A4AC000-memory.dmp

                Filesize

                240KB

              • memory/1772-54-0x0000000072F90000-0x0000000073740000-memory.dmp

                Filesize

                7.7MB

              • memory/1772-55-0x0000000004F90000-0x0000000004FA0000-memory.dmp

                Filesize

                64KB

              • memory/1772-50-0x000000000A4D0000-0x000000000A5DA000-memory.dmp

                Filesize

                1.0MB

              • memory/1772-49-0x000000000A980000-0x000000000AF98000-memory.dmp

                Filesize

                6.1MB

              • memory/1772-48-0x0000000072F90000-0x0000000073740000-memory.dmp

                Filesize

                7.7MB

              • memory/1772-47-0x0000000000660000-0x0000000000690000-memory.dmp

                Filesize

                192KB