Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230824-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2023, 19:11

General

  • Target

    1d38eab4e2889ce0d028c8c33d5126e330d65a727b947a59d66463634b6f1289.exe

  • Size

    705KB

  • MD5

    e667d67071d3d5b5f3a4436a3d373924

  • SHA1

    caa5d4dfaf43aa2dcd8cd8cf2a202dd9ea403ac8

  • SHA256

    1d38eab4e2889ce0d028c8c33d5126e330d65a727b947a59d66463634b6f1289

  • SHA512

    ccea9e50b7ee3476d6a850f3f500bea367b0a6ed1b700393677a4cc0a8a4262bb4b6da345ec5fed98b0d7fac1895e234ad2e783ee9eeb2ebe3f183f043220fb7

  • SSDEEP

    12288:YMrJy90Z4UD72Q//Iigu8ErP1wcFbN81SCbbIR5rKhNcPdKMPDGmxQKFwfl6mFKM:hycD/JntxN81SCbbILGNEKqymxQKal6C

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

jaja

C2

77.91.124.73:19071

Attributes
  • auth_value

    3670179d176ca399ed08e7914610b43c

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1d38eab4e2889ce0d028c8c33d5126e330d65a727b947a59d66463634b6f1289.exe
    "C:\Users\Admin\AppData\Local\Temp\1d38eab4e2889ce0d028c8c33d5126e330d65a727b947a59d66463634b6f1289.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5143166.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5143166.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1409982.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1409982.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4924
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9031959.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9031959.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:5064
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g6533725.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g6533725.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2332
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5523712.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5523712.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3576
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1688
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:1816
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:5092
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:468
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:3260
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:2796
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:2664
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:4416
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:2244
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:1112
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i9192151.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i9192151.exe
                      4⤵
                      • Executes dropped EXE
                      PID:4976
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:3224
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4156
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4844

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5143166.exe

                Filesize

                599KB

                MD5

                868b4c04f1364a1c8500dde5b05604fb

                SHA1

                b481c6e4c6955fef5715b5ea97e81c6b7e5bdab4

                SHA256

                94430d3c04ce1300adcb29e6286f8c43eb93296379b4b21336409d9d5165806f

                SHA512

                065ae1cefa1b19117fcfcb29dd4572d404bba18333cee2c45d7c98010062881de10fe9497d5f9365b9b6ccb319a63aa78c43e2c9244b5614bba47f5798f9689a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5143166.exe

                Filesize

                599KB

                MD5

                868b4c04f1364a1c8500dde5b05604fb

                SHA1

                b481c6e4c6955fef5715b5ea97e81c6b7e5bdab4

                SHA256

                94430d3c04ce1300adcb29e6286f8c43eb93296379b4b21336409d9d5165806f

                SHA512

                065ae1cefa1b19117fcfcb29dd4572d404bba18333cee2c45d7c98010062881de10fe9497d5f9365b9b6ccb319a63aa78c43e2c9244b5614bba47f5798f9689a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1409982.exe

                Filesize

                433KB

                MD5

                981bea52163ab015a6d39202e765ef62

                SHA1

                2a3fc7b823cc1dd217e9b338cb64d778e02243b7

                SHA256

                f39fbed387cb24a5ff21a349bdb8411890f8ef8eaa2c006fc19e11f412ac64a5

                SHA512

                cb08fa15546c7fbd4ce2ea5b0c9558cd04744432de9feebe9c083df6cfc59eeb382206b9df83183adfdc9e6155391b85f1156deab607e8a91e52d79c613cadfe

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1409982.exe

                Filesize

                433KB

                MD5

                981bea52163ab015a6d39202e765ef62

                SHA1

                2a3fc7b823cc1dd217e9b338cb64d778e02243b7

                SHA256

                f39fbed387cb24a5ff21a349bdb8411890f8ef8eaa2c006fc19e11f412ac64a5

                SHA512

                cb08fa15546c7fbd4ce2ea5b0c9558cd04744432de9feebe9c083df6cfc59eeb382206b9df83183adfdc9e6155391b85f1156deab607e8a91e52d79c613cadfe

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i9192151.exe

                Filesize

                174KB

                MD5

                0abb237a6df7562ba309d77dd65312be

                SHA1

                83209114f864faebacdc7f10cc6faf6b884c04af

                SHA256

                97f2823fc6cffc91df9df6255da67a84e1f4206b929183c98b112cd82f73bebf

                SHA512

                d466203fdfbadc89e19f40fd0d5e9eb6efa71b676c07422abf492c58da6e36a8fa159c0366fab72acee260d0f98bcf2d6a48df5626e6e4527ef03a0f0a6973ea

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i9192151.exe

                Filesize

                174KB

                MD5

                0abb237a6df7562ba309d77dd65312be

                SHA1

                83209114f864faebacdc7f10cc6faf6b884c04af

                SHA256

                97f2823fc6cffc91df9df6255da67a84e1f4206b929183c98b112cd82f73bebf

                SHA512

                d466203fdfbadc89e19f40fd0d5e9eb6efa71b676c07422abf492c58da6e36a8fa159c0366fab72acee260d0f98bcf2d6a48df5626e6e4527ef03a0f0a6973ea

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9031959.exe

                Filesize

                277KB

                MD5

                3c58d6541ad05361f528b5d1db1fd468

                SHA1

                5e24f40a0a348b2348f102017fe990efc17c7215

                SHA256

                de922856fb7bfb3c9c0dcc52265b14574e51b0f5b5ac05cf3d48a6b23d29e0fc

                SHA512

                89877830d83dfe5314f75e48be546081977cf4581f2a6d51a48d6c43d69caf809371d39931899adf629e1673ccb3e7e970d1119da2e2895824e434c4d1d992c8

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9031959.exe

                Filesize

                277KB

                MD5

                3c58d6541ad05361f528b5d1db1fd468

                SHA1

                5e24f40a0a348b2348f102017fe990efc17c7215

                SHA256

                de922856fb7bfb3c9c0dcc52265b14574e51b0f5b5ac05cf3d48a6b23d29e0fc

                SHA512

                89877830d83dfe5314f75e48be546081977cf4581f2a6d51a48d6c43d69caf809371d39931899adf629e1673ccb3e7e970d1119da2e2895824e434c4d1d992c8

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g6533725.exe

                Filesize

                14KB

                MD5

                9e76099f7a4247de6b058279692b5e32

                SHA1

                5bea3724c057e7378cf436869280cc8634d837a0

                SHA256

                34f0e00129636feb6a1913658b43cf7ce9470b02f19c5c443e8d92e4ae566727

                SHA512

                3e468e7ff9bcfec0e8561ebbd17cb55de2ac4f6ba6f8852114a9a833d67ba1bc655b77c5b36a130f5f3495f2c10e5fcc45e5d0e2896a8fcf3b6542530d2d09cc

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g6533725.exe

                Filesize

                14KB

                MD5

                9e76099f7a4247de6b058279692b5e32

                SHA1

                5bea3724c057e7378cf436869280cc8634d837a0

                SHA256

                34f0e00129636feb6a1913658b43cf7ce9470b02f19c5c443e8d92e4ae566727

                SHA512

                3e468e7ff9bcfec0e8561ebbd17cb55de2ac4f6ba6f8852114a9a833d67ba1bc655b77c5b36a130f5f3495f2c10e5fcc45e5d0e2896a8fcf3b6542530d2d09cc

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5523712.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h5523712.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                319KB

                MD5

                7a7ac4b97766086a8a7d1af4244c1f21

                SHA1

                5b05f65675fcb5a16afe00ba5a117bafadccd5af

                SHA256

                b9c27d75cc3a707bc36012c58965dc1555628e16e36ba39f6b26067309324b66

                SHA512

                2880fdcc64d0669cd0fc4b8bf5d8aaffd583eed6cbf07633e6d83a34e3f676ad64a737f49a1f57a32aead5ae1cd4470e34c0564087c0df5c6899e5aecaac3b60

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • memory/2332-28-0x00000000004B0000-0x00000000004BA000-memory.dmp

                Filesize

                40KB

              • memory/2332-34-0x00007FFA7D740000-0x00007FFA7E201000-memory.dmp

                Filesize

                10.8MB

              • memory/2332-29-0x00007FFA7D740000-0x00007FFA7E201000-memory.dmp

                Filesize

                10.8MB

              • memory/4976-52-0x0000000004A40000-0x0000000004A52000-memory.dmp

                Filesize

                72KB

              • memory/4976-53-0x0000000004AA0000-0x0000000004ADC000-memory.dmp

                Filesize

                240KB

              • memory/4976-51-0x0000000002250000-0x0000000002260000-memory.dmp

                Filesize

                64KB

              • memory/4976-55-0x0000000072E40000-0x00000000735F0000-memory.dmp

                Filesize

                7.7MB

              • memory/4976-56-0x0000000002250000-0x0000000002260000-memory.dmp

                Filesize

                64KB

              • memory/4976-50-0x0000000004B00000-0x0000000004C0A000-memory.dmp

                Filesize

                1.0MB

              • memory/4976-49-0x0000000005010000-0x0000000005628000-memory.dmp

                Filesize

                6.1MB

              • memory/4976-48-0x00000000000C0000-0x00000000000F0000-memory.dmp

                Filesize

                192KB

              • memory/4976-47-0x0000000072E40000-0x00000000735F0000-memory.dmp

                Filesize

                7.7MB