Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe
Resource
win10v2004-20230703-en
General
-
Target
49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe
-
Size
1.4MB
-
MD5
5a22f920615069545f5cacb89f24dddd
-
SHA1
bc46fd49790be457c1f5370a8cd39c9898387863
-
SHA256
49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098
-
SHA512
1d99f54ec3bdd0375cda19a6926c45cb910707914b645f2fbc2822b0150a14e11e6e0d24af3900aab816d6f481dc287de125abefba738abe56b33f7f704a46b6
-
SSDEEP
24576:fytgZwwaIh1UKY8rL414Pmgm2lMcmzNMYWQgcwQVwhB/4aB8arTMVu69y8u5PF5:qeZwwR/UKY8rwW7NMzOYWJcdwhuiDrCg
Malware Config
Extracted
amadey
3.87
77.91.68.18/nice/index.php
Extracted
redline
nrava
77.91.124.82:19071
-
auth_value
43fe50e9ee6afb85588e03ac9676e2f7
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
resource yara_rule behavioral1/files/0x000600000002320f-41.dat family_redline behavioral1/files/0x000600000002320f-42.dat family_redline behavioral1/memory/2132-43-0x0000000000430000-0x0000000000460000-memory.dmp family_redline -
Executes dropped EXE 9 IoCs
pid Process 2860 y3490276.exe 1328 y2973676.exe 648 y3066015.exe 1436 l7107989.exe 2376 saves.exe 2120 m7430937.exe 2132 n7858719.exe 1996 saves.exe 1156 saves.exe -
Loads dropped DLL 1 IoCs
pid Process 3732 rundll32.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" y3066015.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y3490276.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" y2973676.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4908 schtasks.exe -
Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1216 wrote to memory of 2860 1216 49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe 80 PID 1216 wrote to memory of 2860 1216 49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe 80 PID 1216 wrote to memory of 2860 1216 49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe 80 PID 2860 wrote to memory of 1328 2860 y3490276.exe 81 PID 2860 wrote to memory of 1328 2860 y3490276.exe 81 PID 2860 wrote to memory of 1328 2860 y3490276.exe 81 PID 1328 wrote to memory of 648 1328 y2973676.exe 82 PID 1328 wrote to memory of 648 1328 y2973676.exe 82 PID 1328 wrote to memory of 648 1328 y2973676.exe 82 PID 648 wrote to memory of 1436 648 y3066015.exe 83 PID 648 wrote to memory of 1436 648 y3066015.exe 83 PID 648 wrote to memory of 1436 648 y3066015.exe 83 PID 1436 wrote to memory of 2376 1436 l7107989.exe 84 PID 1436 wrote to memory of 2376 1436 l7107989.exe 84 PID 1436 wrote to memory of 2376 1436 l7107989.exe 84 PID 648 wrote to memory of 2120 648 y3066015.exe 85 PID 648 wrote to memory of 2120 648 y3066015.exe 85 PID 648 wrote to memory of 2120 648 y3066015.exe 85 PID 2376 wrote to memory of 4908 2376 saves.exe 87 PID 2376 wrote to memory of 4908 2376 saves.exe 87 PID 2376 wrote to memory of 4908 2376 saves.exe 87 PID 2376 wrote to memory of 2396 2376 saves.exe 89 PID 2376 wrote to memory of 2396 2376 saves.exe 89 PID 2376 wrote to memory of 2396 2376 saves.exe 89 PID 2396 wrote to memory of 2720 2396 cmd.exe 91 PID 2396 wrote to memory of 2720 2396 cmd.exe 91 PID 2396 wrote to memory of 2720 2396 cmd.exe 91 PID 2396 wrote to memory of 2484 2396 cmd.exe 92 PID 2396 wrote to memory of 2484 2396 cmd.exe 92 PID 2396 wrote to memory of 2484 2396 cmd.exe 92 PID 2396 wrote to memory of 3036 2396 cmd.exe 93 PID 2396 wrote to memory of 3036 2396 cmd.exe 93 PID 2396 wrote to memory of 3036 2396 cmd.exe 93 PID 2396 wrote to memory of 3332 2396 cmd.exe 94 PID 2396 wrote to memory of 3332 2396 cmd.exe 94 PID 2396 wrote to memory of 3332 2396 cmd.exe 94 PID 2396 wrote to memory of 396 2396 cmd.exe 95 PID 2396 wrote to memory of 396 2396 cmd.exe 95 PID 2396 wrote to memory of 396 2396 cmd.exe 95 PID 2396 wrote to memory of 2436 2396 cmd.exe 96 PID 2396 wrote to memory of 2436 2396 cmd.exe 96 PID 2396 wrote to memory of 2436 2396 cmd.exe 96 PID 1328 wrote to memory of 2132 1328 y2973676.exe 99 PID 1328 wrote to memory of 2132 1328 y2973676.exe 99 PID 1328 wrote to memory of 2132 1328 y2973676.exe 99 PID 2376 wrote to memory of 3732 2376 saves.exe 106 PID 2376 wrote to memory of 3732 2376 saves.exe 106 PID 2376 wrote to memory of 3732 2376 saves.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe"C:\Users\Admin\AppData\Local\Temp\49eef199e58bf8a60267d58ece816e6d9d162b184dea2ebb2172c22068738098.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3490276.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3490276.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2973676.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2973676.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3066015.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\y3066015.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:648 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l7107989.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\l7107989.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F7⤵
- Creates scheduled task(s)
PID:4908
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit7⤵
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:2720
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:N"8⤵PID:2484
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "saves.exe" /P "Admin:R" /E8⤵PID:3036
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"8⤵PID:3332
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:N"8⤵PID:396
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\b40d11255d" /P "Admin:R" /E8⤵PID:2436
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:3732
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m7430937.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\m7430937.exe5⤵
- Executes dropped EXE
PID:2120
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n7858719.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n7858719.exe4⤵
- Executes dropped EXE
PID:2132
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1996
-
C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exeC:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe1⤵
- Executes dropped EXE
PID:1156
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD56bed90c2400c145b5488218a899d64e8
SHA1346dc86a9b8df5f2c4cef59b36aaa9271d0599d2
SHA256b4a34b023262dcde33c08cbc965c7126e364b20b67a81f5cf0f6b7434b26194a
SHA51283769f2d4398d3443a26afe8ddedb109ea5842c6e4d1745179536b33b3926e2dffdcf52528df5a4f657ba55d12272cf9c4560ce466d2ed7dc6514321c9f102f6
-
Filesize
1.3MB
MD56bed90c2400c145b5488218a899d64e8
SHA1346dc86a9b8df5f2c4cef59b36aaa9271d0599d2
SHA256b4a34b023262dcde33c08cbc965c7126e364b20b67a81f5cf0f6b7434b26194a
SHA51283769f2d4398d3443a26afe8ddedb109ea5842c6e4d1745179536b33b3926e2dffdcf52528df5a4f657ba55d12272cf9c4560ce466d2ed7dc6514321c9f102f6
-
Filesize
476KB
MD5dd3e9d321a72de85f659b0aa4e8608f9
SHA180069caded43c0579e677c7f36448c010b3844f6
SHA256a02a797614a38df0b48d0f7bae5da011f911593c6c8d66526fa18ca44abda64c
SHA5127482f7c1b75a50e00345fbb3b6473562ee7c81a3380845d338eca53baad6894c65173cccc71763a869ca27586ebf50db5462d413ff55d2180a28f095bc4be262
-
Filesize
476KB
MD5dd3e9d321a72de85f659b0aa4e8608f9
SHA180069caded43c0579e677c7f36448c010b3844f6
SHA256a02a797614a38df0b48d0f7bae5da011f911593c6c8d66526fa18ca44abda64c
SHA5127482f7c1b75a50e00345fbb3b6473562ee7c81a3380845d338eca53baad6894c65173cccc71763a869ca27586ebf50db5462d413ff55d2180a28f095bc4be262
-
Filesize
173KB
MD5075d98b6313eea7ab5208b075dd99aa4
SHA12bd3fdb3d7ea98d604b9642a911772ee84e3740f
SHA256a3cbce81a47d0584e7166b56f74d21dd8138c4e655a5797f9af42fc0d2cd0686
SHA512892bfa3590017f0cf83eb05d2b533f413141167a6f662facb20e1d626e56fa21cd519947db429658210be0c262d2d49c24f19c4644bea3d88edf5473300c40c3
-
Filesize
173KB
MD5075d98b6313eea7ab5208b075dd99aa4
SHA12bd3fdb3d7ea98d604b9642a911772ee84e3740f
SHA256a3cbce81a47d0584e7166b56f74d21dd8138c4e655a5797f9af42fc0d2cd0686
SHA512892bfa3590017f0cf83eb05d2b533f413141167a6f662facb20e1d626e56fa21cd519947db429658210be0c262d2d49c24f19c4644bea3d88edf5473300c40c3
-
Filesize
320KB
MD5281dbbe458902ff57c2d430f23597f09
SHA1d252f865793db8cd9deca901dc61da9ff20ee2ce
SHA256d2e6ee6588f1f2b172cb008cb960376eed790d6b92923bb225f313eba14583ac
SHA51202637b911e9039a29f56f2b4859cdbcac7d59631e82fc34b907d1d109956f45892c416162eb7d76f37cac8e331d1f3bc9b330f5acdfde2c124dd452b6e492004
-
Filesize
320KB
MD5281dbbe458902ff57c2d430f23597f09
SHA1d252f865793db8cd9deca901dc61da9ff20ee2ce
SHA256d2e6ee6588f1f2b172cb008cb960376eed790d6b92923bb225f313eba14583ac
SHA51202637b911e9039a29f56f2b4859cdbcac7d59631e82fc34b907d1d109956f45892c416162eb7d76f37cac8e331d1f3bc9b330f5acdfde2c124dd452b6e492004
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
140KB
MD59005b4bde8bfdf12f85a2654fc6525d5
SHA1f67f25538785b51ad4fc08573e7081bfd5da0743
SHA256a83fbbd050357271ca9670f5c7c3c664ae9e9ca298a142046be21895232eaddf
SHA512c72e328a3e674ba57ccdb5e9cae5c60007592ae853fc830b09004dd4d6f5005daf007727f38f5a3da71c345819a64c1231168ce02e10837362caddd710a67ee0
-
Filesize
140KB
MD59005b4bde8bfdf12f85a2654fc6525d5
SHA1f67f25538785b51ad4fc08573e7081bfd5da0743
SHA256a83fbbd050357271ca9670f5c7c3c664ae9e9ca298a142046be21895232eaddf
SHA512c72e328a3e674ba57ccdb5e9cae5c60007592ae853fc830b09004dd4d6f5005daf007727f38f5a3da71c345819a64c1231168ce02e10837362caddd710a67ee0
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
321KB
MD51cf53ccfd6ce1c1c737142ba5e59175a
SHA18b4711fe54140286dd68228e5923335fc7c8126a
SHA2569ac246683a70241940e23453a8b5c0d10c4d7d15d18cca9cbb1e6b4d63191377
SHA512d599facd6c8bf899311807ba9186b017516f6149e26b634f5122e17e1ac8eddb96503975b439a67f9762a03edac498fcf71e164fca304d54b9014306028e2887
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
89KB
MD55bc0153d2973241b72a38c51a2f72116
SHA1cd9c689663557452631d9f8ff609208b01884a32
SHA25668ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554
SHA5122eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b
-
Filesize
273B
MD5374bfdcfcf19f4edfe949022092848d2
SHA1df5ee40497e98efcfba30012452d433373d287d4
SHA256224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f
SHA512bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7