Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2023, 03:33

General

  • Target

    7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe

  • Size

    705KB

  • MD5

    4e8e8c50e37b202e6aab7b15c133a7bc

  • SHA1

    5c517b4878c91ccb4da509be49eeccf3fc24364c

  • SHA256

    7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2

  • SHA512

    ae0bb172eb5b6ed1464dcebf25c91c6718de747f391d53937e929d78ee185eae3d6926492ed7252d27f90d508ff40d3ad3dcfff518fc14b6ec96767360d4edd7

  • SSDEEP

    12288:ZMrny9044SidEzVCvwHxIJjzKPfKImB6ce5AMl8DaDUbpCO/yBneQyfl9/e:eyN4SiWGIIpzyfLxl8DpBfFfL2

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

stas

C2

77.91.124.82:19071

Attributes
  • auth_value

    db6d96c4eade05afc28c31d9ad73a73c

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe
    "C:\Users\Admin\AppData\Local\Temp\7654cf704f1123ff992c978a118d52afaef4394970bfac2ededc1f2fb197ffa2.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6805666.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6805666.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4440
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5210512.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5210512.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1564
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4024038.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4024038.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:864
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1952567.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1952567.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3076
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7587309.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7587309.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3740
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4572
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:4860
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1000
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:4444
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:3716
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:1068
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:3676
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:3844
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:4272
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:1760
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4104346.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4104346.exe
                      4⤵
                      • Executes dropped EXE
                      PID:2056
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4260
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:1712

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6805666.exe

                Filesize

                599KB

                MD5

                b1f043e5beb5686ed2e417d2da48c1f0

                SHA1

                3a539d92780a320ca554e35bc010971f154559a2

                SHA256

                09cd981e54e1530cebca445ebadb674439de12646ead08d5c692e25ef76774a8

                SHA512

                659df817d9189dc42eda0de6c696c0422a00883bc1da6de7f273d3502edcc47ec2af9409894788efe073046d6ec9b79d0bc15743b73261f3acbe3e194356258a

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x6805666.exe

                Filesize

                599KB

                MD5

                b1f043e5beb5686ed2e417d2da48c1f0

                SHA1

                3a539d92780a320ca554e35bc010971f154559a2

                SHA256

                09cd981e54e1530cebca445ebadb674439de12646ead08d5c692e25ef76774a8

                SHA512

                659df817d9189dc42eda0de6c696c0422a00883bc1da6de7f273d3502edcc47ec2af9409894788efe073046d6ec9b79d0bc15743b73261f3acbe3e194356258a

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5210512.exe

                Filesize

                433KB

                MD5

                0ee160349603c4b70e8d60f7b80f509f

                SHA1

                2241b00b11b9062a6224e20a4a47bd627339d22c

                SHA256

                20b5bf02f25929a7e5c8b8c4ea92de97a6b1f922627a30d05c0f7e8cf70e3217

                SHA512

                906d52570b059496cc446eddddaae5369a3274a162e5733845168474a50c0c9a6383b234de585d522ca5e1b61d70e55c25a3a2669b4be229dc3814223696a122

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x5210512.exe

                Filesize

                433KB

                MD5

                0ee160349603c4b70e8d60f7b80f509f

                SHA1

                2241b00b11b9062a6224e20a4a47bd627339d22c

                SHA256

                20b5bf02f25929a7e5c8b8c4ea92de97a6b1f922627a30d05c0f7e8cf70e3217

                SHA512

                906d52570b059496cc446eddddaae5369a3274a162e5733845168474a50c0c9a6383b234de585d522ca5e1b61d70e55c25a3a2669b4be229dc3814223696a122

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4104346.exe

                Filesize

                174KB

                MD5

                2d18f43392917f6aaf9800229803c164

                SHA1

                bb5b37a83e7a177b588376b4e24bdb97e37111b3

                SHA256

                1117eeb94f380a1fb2304dd4a81bb18f3df91a1e6aeb48f18ef509360455dc10

                SHA512

                90e3b49065ba5cf1b6e3ce8e4244fd7c293ede73bc55dc80e28fb96f1f664be5220acf4ca067b6fa9ef4d65aa8f84d2bb132c767f322ca422842fbaf84cf5ba9

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i4104346.exe

                Filesize

                174KB

                MD5

                2d18f43392917f6aaf9800229803c164

                SHA1

                bb5b37a83e7a177b588376b4e24bdb97e37111b3

                SHA256

                1117eeb94f380a1fb2304dd4a81bb18f3df91a1e6aeb48f18ef509360455dc10

                SHA512

                90e3b49065ba5cf1b6e3ce8e4244fd7c293ede73bc55dc80e28fb96f1f664be5220acf4ca067b6fa9ef4d65aa8f84d2bb132c767f322ca422842fbaf84cf5ba9

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4024038.exe

                Filesize

                277KB

                MD5

                a869764d091fa7d328081d88be2a5bd5

                SHA1

                6437424cc106ad8391cc2bd9934558df55665a43

                SHA256

                66ba47bbbad6e3cbc7b7d20873b6862b5b74aaafc7a873f6c09a6c5ef26eb684

                SHA512

                5ab38354ff9654c94e35d6c92e0651a687dc9676498b33420ef9b4fd27aabf9cb914efb5c11ebc938e3877d4d1847a4c3e38705cf5660665d485ed03f5c9f02a

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4024038.exe

                Filesize

                277KB

                MD5

                a869764d091fa7d328081d88be2a5bd5

                SHA1

                6437424cc106ad8391cc2bd9934558df55665a43

                SHA256

                66ba47bbbad6e3cbc7b7d20873b6862b5b74aaafc7a873f6c09a6c5ef26eb684

                SHA512

                5ab38354ff9654c94e35d6c92e0651a687dc9676498b33420ef9b4fd27aabf9cb914efb5c11ebc938e3877d4d1847a4c3e38705cf5660665d485ed03f5c9f02a

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1952567.exe

                Filesize

                15KB

                MD5

                4903424d41d3eba34126f22f2568f5aa

                SHA1

                6d930af02607852b9bacf5fd5731f11445ca2e03

                SHA256

                cbb59c886e09f9c04a731e8c0a2ebe2b31b79f53ded34ad55690889371ddbd03

                SHA512

                c6f1f69e98ce915a69512ac8ab7fc1f95ca63fad061c25b976a4125df45245cb14e10fb75a2cd2295ebc8fe2d071b364b02228b302ba179b26ac3946228534cb

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g1952567.exe

                Filesize

                15KB

                MD5

                4903424d41d3eba34126f22f2568f5aa

                SHA1

                6d930af02607852b9bacf5fd5731f11445ca2e03

                SHA256

                cbb59c886e09f9c04a731e8c0a2ebe2b31b79f53ded34ad55690889371ddbd03

                SHA512

                c6f1f69e98ce915a69512ac8ab7fc1f95ca63fad061c25b976a4125df45245cb14e10fb75a2cd2295ebc8fe2d071b364b02228b302ba179b26ac3946228534cb

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7587309.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h7587309.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                323KB

                MD5

                d8b1ff05f1f381d2a9890b6b914cce93

                SHA1

                61d356a37e6a409177fb12bb8060e622d19178df

                SHA256

                3a2e754288822a6fcc05c3be9c92fc9f182685f1b66ee3944d3d9bfc09a34089

                SHA512

                2b1c61f8fa09c7f9d76efd196f88abfa463dc6ac193b0e4f3669cc17e01f5f225bb4792e0358c6527340901cf564decb7d10e8fa29196f95c7c94787f15081ac

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • memory/2056-53-0x00000000054F0000-0x000000000552C000-memory.dmp

                Filesize

                240KB

              • memory/2056-51-0x0000000005490000-0x00000000054A2000-memory.dmp

                Filesize

                72KB

              • memory/2056-52-0x0000000005430000-0x0000000005440000-memory.dmp

                Filesize

                64KB

              • memory/2056-50-0x0000000005550000-0x000000000565A000-memory.dmp

                Filesize

                1.0MB

              • memory/2056-54-0x0000000073240000-0x00000000739F0000-memory.dmp

                Filesize

                7.7MB

              • memory/2056-55-0x0000000005430000-0x0000000005440000-memory.dmp

                Filesize

                64KB

              • memory/2056-49-0x0000000005A60000-0x0000000006078000-memory.dmp

                Filesize

                6.1MB

              • memory/2056-47-0x00000000009D0000-0x0000000000A00000-memory.dmp

                Filesize

                192KB

              • memory/2056-48-0x0000000073240000-0x00000000739F0000-memory.dmp

                Filesize

                7.7MB

              • memory/3076-31-0x00007FFB53E40000-0x00007FFB54901000-memory.dmp

                Filesize

                10.8MB

              • memory/3076-29-0x00007FFB53E40000-0x00007FFB54901000-memory.dmp

                Filesize

                10.8MB

              • memory/3076-28-0x0000000000740000-0x000000000074A000-memory.dmp

                Filesize

                40KB