Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    159s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/08/2023, 22:01

General

  • Target

    c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe

  • Size

    704KB

  • MD5

    165d7eca17598c763fab95a3ac39a0f8

  • SHA1

    c3942133bbd530eebd410a49089365b314836bf0

  • SHA256

    c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b

  • SHA512

    916512577c81be591d2a6cb060826fae219f7e267256afa1e0d8603fb98cc1a0adf8fc03a4c8b18d4c7a1e4fc94e0b091719a65b3cd1654769838bca564d629c

  • SSDEEP

    12288:KMrhy90WgsFgK/rqA7rdK1eUdBzbtu0LryuTZ3cjck/qIw5Y4NhiB24p:7y0sFNxrae8trLryqTKw5Y4bMx

Malware Config

Extracted

Family

amadey

Version

3.87

C2

77.91.68.18/nice/index.php

Extracted

Family

redline

Botnet

sruta

C2

77.91.124.82:19071

Attributes
  • auth_value

    c556edcd49703319eca74247de20c236

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 3 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe
    "C:\Users\Admin\AppData\Local\Temp\c37fdeeef05ed355f7d5c6787d3eca3cec8e03964689979f67b7a397adb1877b.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3151900.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3151900.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2344
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7168354.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7168354.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x6883375.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x6883375.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:640
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7151445.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7151445.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5052
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h1993551.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h1993551.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3184
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4620
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:4284
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:4936
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:2932
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:1360
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:1568
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:3760
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:3692
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:4292
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
                            7⤵
                            • Loads dropped DLL
                            PID:4040
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1966465.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1966465.exe
                      4⤵
                      • Executes dropped EXE
                      PID:196
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4780
              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                1⤵
                • Executes dropped EXE
                PID:4912

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3151900.exe

                Filesize

                599KB

                MD5

                182ffa85c4126fc32d1a7e58c6529d52

                SHA1

                0076902e05af25318198c0c019becea40008e135

                SHA256

                b3144ddb5b87462c05dc0b888d3b7f80cb07729cca41794e27482e1def43e4ae

                SHA512

                0de6097e2fe09b074a36ee0445ec58424e295510a39edd62a1e761195232a8c78ca005748c5f2eec65f9a547c8c79d6dd38246501e12d79beb23b6db30bd5baf

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3151900.exe

                Filesize

                599KB

                MD5

                182ffa85c4126fc32d1a7e58c6529d52

                SHA1

                0076902e05af25318198c0c019becea40008e135

                SHA256

                b3144ddb5b87462c05dc0b888d3b7f80cb07729cca41794e27482e1def43e4ae

                SHA512

                0de6097e2fe09b074a36ee0445ec58424e295510a39edd62a1e761195232a8c78ca005748c5f2eec65f9a547c8c79d6dd38246501e12d79beb23b6db30bd5baf

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7168354.exe

                Filesize

                432KB

                MD5

                2c298b6b4e16f04aef85f02ed3dd2ffc

                SHA1

                9d0fd920e2d92a659a6377cbfb96359abaccaf5f

                SHA256

                84af2f5b0026674757b6c5410bc4ebfb799d42d8e88ce0bcc4a19fd834124ee1

                SHA512

                f773faff1ce2804f07dac16582b93e00deb3d6adf36d248134452d333d7abab5b9c979460b9aed23853effd87235594f7bff1c205d61db6722a06df9159dea50

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7168354.exe

                Filesize

                432KB

                MD5

                2c298b6b4e16f04aef85f02ed3dd2ffc

                SHA1

                9d0fd920e2d92a659a6377cbfb96359abaccaf5f

                SHA256

                84af2f5b0026674757b6c5410bc4ebfb799d42d8e88ce0bcc4a19fd834124ee1

                SHA512

                f773faff1ce2804f07dac16582b93e00deb3d6adf36d248134452d333d7abab5b9c979460b9aed23853effd87235594f7bff1c205d61db6722a06df9159dea50

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1966465.exe

                Filesize

                174KB

                MD5

                003f51a81e4992e9636b574f52085c64

                SHA1

                42fc611e9bf3390ceb5e70ffae5ffb8b77fb505b

                SHA256

                9e8933a946de6105443ec8f003aa2681aeb66c0f7421c92050fc1598dda04c0d

                SHA512

                cc8213dfa65eda135bb57bff51bf2d1eb8c9a4f1c54753176da97db5e7c0aa562a8d5bd53b631addb8db51f89fd3fd679bac040e63653a5c4e18d3a4de39e0d0

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i1966465.exe

                Filesize

                174KB

                MD5

                003f51a81e4992e9636b574f52085c64

                SHA1

                42fc611e9bf3390ceb5e70ffae5ffb8b77fb505b

                SHA256

                9e8933a946de6105443ec8f003aa2681aeb66c0f7421c92050fc1598dda04c0d

                SHA512

                cc8213dfa65eda135bb57bff51bf2d1eb8c9a4f1c54753176da97db5e7c0aa562a8d5bd53b631addb8db51f89fd3fd679bac040e63653a5c4e18d3a4de39e0d0

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x6883375.exe

                Filesize

                277KB

                MD5

                61113bfe989de194c978d7f2eafb1a9a

                SHA1

                810e78b031b9e6d965676593c4ef819b37e53c52

                SHA256

                c8a35258d9f9911ba757d134851e3568d3f1ac7e21e6f7c9cfac7d00fe47d82e

                SHA512

                3e88366d516fc7bc9fcf1896c61bcaa34ff5732877905882906ac2bd5b9485b880ec04b4f2c6db12feeb2ec784fc6808468244e988440de81ab8fa7fbcad81e9

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x6883375.exe

                Filesize

                277KB

                MD5

                61113bfe989de194c978d7f2eafb1a9a

                SHA1

                810e78b031b9e6d965676593c4ef819b37e53c52

                SHA256

                c8a35258d9f9911ba757d134851e3568d3f1ac7e21e6f7c9cfac7d00fe47d82e

                SHA512

                3e88366d516fc7bc9fcf1896c61bcaa34ff5732877905882906ac2bd5b9485b880ec04b4f2c6db12feeb2ec784fc6808468244e988440de81ab8fa7fbcad81e9

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7151445.exe

                Filesize

                17KB

                MD5

                50777cef43088a7e46f996b8c8f803e6

                SHA1

                7b6332e6a39963b19b73c3db61e99bba15bfffb4

                SHA256

                586122041194727e07015f4f6dffcc3dda95759fac98d45926dd87048acc4b6a

                SHA512

                10c750a475a5857b23065d1f188f847443cf80096f68f823ff9e76dd605f59f0d442ba79058ddda8e8a52109d96d98aaa77034d0e2a80a3519c3708b9f8164a3

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7151445.exe

                Filesize

                17KB

                MD5

                50777cef43088a7e46f996b8c8f803e6

                SHA1

                7b6332e6a39963b19b73c3db61e99bba15bfffb4

                SHA256

                586122041194727e07015f4f6dffcc3dda95759fac98d45926dd87048acc4b6a

                SHA512

                10c750a475a5857b23065d1f188f847443cf80096f68f823ff9e76dd605f59f0d442ba79058ddda8e8a52109d96d98aaa77034d0e2a80a3519c3708b9f8164a3

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h1993551.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h1993551.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe

                Filesize

                326KB

                MD5

                059a40d511fba3b193a99222f9a9939d

                SHA1

                4b47a464c2b4bd8d29c4a6e93e0bd357c2cf611d

                SHA256

                13aa5f924a6ebdefdeb3e59ab25861bf10435c23d2914675ea30759c4d0f4bea

                SHA512

                cc90b36561f9b607280cd3621390898a56bf099c218e5aacf6363c11f933c1557b189c477462196266585d5193d620d0ba1fbfba68aefa48b8d35a67b3ef3a82

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

                Filesize

                273B

                MD5

                374bfdcfcf19f4edfe949022092848d2

                SHA1

                df5ee40497e98efcfba30012452d433373d287d4

                SHA256

                224a123b69af5a3ab0553e334f6c70846c650597a63f6336c9420bbe8f00571f

                SHA512

                bc66dd6e675942a8b8cd776b0813d4b182091e45bfa7734b3818f58c83d04f81f0599a27625ff345d393959b8dbe478d8f1ed33d49f9bcee052c986c8665b8d7

              • \Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

                Filesize

                89KB

                MD5

                5bc0153d2973241b72a38c51a2f72116

                SHA1

                cd9c689663557452631d9f8ff609208b01884a32

                SHA256

                68ec0ef5c26d0204c713ec50f6ad66f8029063c6a9dbd51836f4942bacace554

                SHA512

                2eef4cc2568b18559f2a2a87d1fcde1f3b77f7aba23dc4483be409cb2c4722ebf89bd1316f785cbb9a21e8d017446e0d876442aec77bf8f28b198aead2b9a55b

              • memory/196-50-0x0000000009E00000-0x0000000009E3E000-memory.dmp

                Filesize

                248KB

              • memory/196-48-0x0000000009E70000-0x0000000009F7A000-memory.dmp

                Filesize

                1.0MB

              • memory/196-49-0x0000000009DA0000-0x0000000009DB2000-memory.dmp

                Filesize

                72KB

              • memory/196-47-0x000000000A2E0000-0x000000000A8E6000-memory.dmp

                Filesize

                6.0MB

              • memory/196-51-0x0000000009F80000-0x0000000009FCB000-memory.dmp

                Filesize

                300KB

              • memory/196-52-0x00000000724C0000-0x0000000072BAE000-memory.dmp

                Filesize

                6.9MB

              • memory/196-46-0x0000000004920000-0x0000000004926000-memory.dmp

                Filesize

                24KB

              • memory/196-45-0x00000000724C0000-0x0000000072BAE000-memory.dmp

                Filesize

                6.9MB

              • memory/196-44-0x0000000000060000-0x0000000000090000-memory.dmp

                Filesize

                192KB

              • memory/5052-31-0x00007FFC7EA90000-0x00007FFC7F47C000-memory.dmp

                Filesize

                9.9MB

              • memory/5052-29-0x00007FFC7EA90000-0x00007FFC7F47C000-memory.dmp

                Filesize

                9.9MB

              • memory/5052-28-0x0000000000440000-0x000000000044A000-memory.dmp

                Filesize

                40KB