Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 04:58

General

  • Target

    c628953c10d54e957d17721468ecd5d954a3096d96b7e4f23823d55cfa6b7359.exe

  • Size

    928KB

  • MD5

    982778b4358e2bfcdcb3d1f9f849cea8

  • SHA1

    fe22b58030a0a222f414c5083deb681ac6cda9fc

  • SHA256

    c628953c10d54e957d17721468ecd5d954a3096d96b7e4f23823d55cfa6b7359

  • SHA512

    efebc7e5db6ea636b85453d914555c33422c6307bbe50dd9bce3aeb940e983a3427a55e580e48826e7b6abf731fa57f257d0ae20f7a24a9a4b5cf45f2bbad71a

  • SSDEEP

    24576:lybVUlyjCTtX+fJpwWChynpokECz6rtPFcW1EjYm:AbVK5X+fJpwWCwokECmR6Qh

Malware Config

Extracted

Family

redline

Botnet

luska

C2

77.91.124.55:19071

Attributes
  • auth_value

    a6797888f51a88afbfd8854a79ac9357

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c628953c10d54e957d17721468ecd5d954a3096d96b7e4f23823d55cfa6b7359.exe
    "C:\Users\Admin\AppData\Local\Temp\c628953c10d54e957d17721468ecd5d954a3096d96b7e4f23823d55cfa6b7359.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3304
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5929040.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5929040.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7414518.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7414518.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3352
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4237956.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4237956.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3768
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5349699.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5349699.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:3928
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
                PID:1112
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                  PID:2528
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 540
                    7⤵
                    • Program crash
                    PID:2456
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 148
                  6⤵
                  • Program crash
                  PID:3660
              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h4835354.exe
                C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h4835354.exe
                5⤵
                • Executes dropped EXE
                PID:4428
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3928 -ip 3928
        1⤵
          PID:3248
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2528 -ip 2528
          1⤵
            PID:5008

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5929040.exe

            Filesize

            826KB

            MD5

            f186a3ee41e930f5da41ce3f68b4b681

            SHA1

            a584570d2513675a40c6feca50b882f517d5f6f8

            SHA256

            8303a68b5e2204a698d2ed31c768dd0026d84f7d242cfed55d72948b8d999279

            SHA512

            3305d1564a4390ef5a2882e946ee499c484e5a45fa10f883e9d04f064ec7e08744461f618c028d72cf23d6f8723d45ecc46df3630f1b6ed9a0f850945dfed2bd

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x5929040.exe

            Filesize

            826KB

            MD5

            f186a3ee41e930f5da41ce3f68b4b681

            SHA1

            a584570d2513675a40c6feca50b882f517d5f6f8

            SHA256

            8303a68b5e2204a698d2ed31c768dd0026d84f7d242cfed55d72948b8d999279

            SHA512

            3305d1564a4390ef5a2882e946ee499c484e5a45fa10f883e9d04f064ec7e08744461f618c028d72cf23d6f8723d45ecc46df3630f1b6ed9a0f850945dfed2bd

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7414518.exe

            Filesize

            555KB

            MD5

            0e17859cfc66165f8e47674fa21e4c44

            SHA1

            ca626696b487f9f21ce780589f249bc692717ebe

            SHA256

            2e39c69d85a87f57498bc86031b244a253168feb37776324a3a1bc81da173cd4

            SHA512

            faa8390465f351d2eac84217bb91534c6b8190fa40b5e05e479def7e7430cc68ded4d164e806351aa1d5e12334463cc8719468913dd6e91d3d811e43f534ddc6

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7414518.exe

            Filesize

            555KB

            MD5

            0e17859cfc66165f8e47674fa21e4c44

            SHA1

            ca626696b487f9f21ce780589f249bc692717ebe

            SHA256

            2e39c69d85a87f57498bc86031b244a253168feb37776324a3a1bc81da173cd4

            SHA512

            faa8390465f351d2eac84217bb91534c6b8190fa40b5e05e479def7e7430cc68ded4d164e806351aa1d5e12334463cc8719468913dd6e91d3d811e43f534ddc6

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4237956.exe

            Filesize

            389KB

            MD5

            d0ec86fa6d83c46557cbfbb505aaca8e

            SHA1

            af2fb64884276cd9c327a36248af654c1810ac60

            SHA256

            2536003fadb5857043bd66745889c686803adf1ce3810b4d2967cf3bd9df0b68

            SHA512

            155ec0344a166682b4033801705609b7f309356543c02a1f190ebd2a4555404690bf1f7ceec3dc0458771245001738e8b43e6dc69b0f20f172dc46432c618b5a

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x4237956.exe

            Filesize

            389KB

            MD5

            d0ec86fa6d83c46557cbfbb505aaca8e

            SHA1

            af2fb64884276cd9c327a36248af654c1810ac60

            SHA256

            2536003fadb5857043bd66745889c686803adf1ce3810b4d2967cf3bd9df0b68

            SHA512

            155ec0344a166682b4033801705609b7f309356543c02a1f190ebd2a4555404690bf1f7ceec3dc0458771245001738e8b43e6dc69b0f20f172dc46432c618b5a

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5349699.exe

            Filesize

            356KB

            MD5

            230f7f2579c06831ed55ec3a685a854b

            SHA1

            20cc3172eab9c3123aa23922e5640c1ce7a05eb7

            SHA256

            bffabc8478c1f14bca83c66aefd8836b552f634915f1cdbd0d410eaf4b8a7415

            SHA512

            6e5ae5226e289f04c76bad547b5d7430aa8cd83a060f27281c23476adbc8da1744d5082b7e8d12e35f28b37f25305ea636b231be09a3f754e03310144a8dc124

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g5349699.exe

            Filesize

            356KB

            MD5

            230f7f2579c06831ed55ec3a685a854b

            SHA1

            20cc3172eab9c3123aa23922e5640c1ce7a05eb7

            SHA256

            bffabc8478c1f14bca83c66aefd8836b552f634915f1cdbd0d410eaf4b8a7415

            SHA512

            6e5ae5226e289f04c76bad547b5d7430aa8cd83a060f27281c23476adbc8da1744d5082b7e8d12e35f28b37f25305ea636b231be09a3f754e03310144a8dc124

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h4835354.exe

            Filesize

            174KB

            MD5

            0ee37e0401582644dbbb276456d8f4df

            SHA1

            6d52fb4961bdee1674181e3b9321a72c86284633

            SHA256

            6aca1be0f026fb910b72777414c7fec5496692e21cbf91581dcb1857e1ac928c

            SHA512

            0cd641447333cd08a9a646326ee79079ff76d2d64e423317bea34a82176d5a9f25568256b8e32fb3a53d18068369a60d103adf054b3577d2dc8d54b590cdbb6f

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h4835354.exe

            Filesize

            174KB

            MD5

            0ee37e0401582644dbbb276456d8f4df

            SHA1

            6d52fb4961bdee1674181e3b9321a72c86284633

            SHA256

            6aca1be0f026fb910b72777414c7fec5496692e21cbf91581dcb1857e1ac928c

            SHA512

            0cd641447333cd08a9a646326ee79079ff76d2d64e423317bea34a82176d5a9f25568256b8e32fb3a53d18068369a60d103adf054b3577d2dc8d54b590cdbb6f

          • memory/2528-29-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/2528-30-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/2528-32-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/2528-28-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/4428-39-0x0000000005100000-0x0000000005718000-memory.dmp

            Filesize

            6.1MB

          • memory/4428-37-0x0000000073F50000-0x0000000074700000-memory.dmp

            Filesize

            7.7MB

          • memory/4428-38-0x0000000002290000-0x0000000002296000-memory.dmp

            Filesize

            24KB

          • memory/4428-36-0x0000000000020000-0x0000000000050000-memory.dmp

            Filesize

            192KB

          • memory/4428-40-0x0000000004BF0000-0x0000000004CFA000-memory.dmp

            Filesize

            1.0MB

          • memory/4428-41-0x00000000048D0000-0x00000000048E0000-memory.dmp

            Filesize

            64KB

          • memory/4428-42-0x0000000004B00000-0x0000000004B12000-memory.dmp

            Filesize

            72KB

          • memory/4428-43-0x0000000004B60000-0x0000000004B9C000-memory.dmp

            Filesize

            240KB

          • memory/4428-44-0x0000000004BA0000-0x0000000004BEC000-memory.dmp

            Filesize

            304KB

          • memory/4428-45-0x0000000073F50000-0x0000000074700000-memory.dmp

            Filesize

            7.7MB

          • memory/4428-46-0x00000000048D0000-0x00000000048E0000-memory.dmp

            Filesize

            64KB