Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 14:14

General

  • Target

    775776201e20d90baeadd21102f4979b564d1df5f501d21c53ab0eb8db9a3512.exe

  • Size

    1.3MB

  • MD5

    c84f1acb197203afcfeac4f3e5c68f04

  • SHA1

    715d2587f0238647b23ccc0679a6e09480c49b65

  • SHA256

    775776201e20d90baeadd21102f4979b564d1df5f501d21c53ab0eb8db9a3512

  • SHA512

    7ba17a99b7ec0292ef12b950e13d0d9a5ff69114b89676ea635b425aceb454d8090b5b85f4c1b1c1e930a7b4440bd8d542fc7b0b7e67dce0779f25e183ad6b92

  • SSDEEP

    24576:kyyr2x3wu+X2BNLgMAaIAen1ZQD9zgCyh8oOKDrh+YArlLakulO0:zyr2x3wVms3aBenMRzt+l+/Ylg

Malware Config

Extracted

Family

redline

Botnet

darts

C2

77.91.124.82:19071

Attributes
  • auth_value

    3c8818da7045365845f15ec0946ebf11

Extracted

Family

redline

Botnet

kendo

C2

77.91.124.82:19071

Attributes
  • auth_value

    5a22a881561d49941415902859b51f14

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\775776201e20d90baeadd21102f4979b564d1df5f501d21c53ab0eb8db9a3512.exe
    "C:\Users\Admin\AppData\Local\Temp\775776201e20d90baeadd21102f4979b564d1df5f501d21c53ab0eb8db9a3512.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9570233.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9570233.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3580
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4570346.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4570346.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5987817.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5987817.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3048
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8962129.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8962129.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2444
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5390003.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5390003.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:3468
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2097350.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2097350.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4572
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3416
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 576
                  8⤵
                  • Program crash
                  PID:4760
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b8120067.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b8120067.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:316
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                    PID:2624
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    8⤵
                      PID:224
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 540
                        9⤵
                        • Program crash
                        PID:3484
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 600
                      8⤵
                      • Program crash
                      PID:1576
                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c5497651.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c5497651.exe
                  6⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4908
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                    7⤵
                      PID:744
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 592
                      7⤵
                      • Program crash
                      PID:4268
                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d9100147.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d9100147.exe
                  5⤵
                  • Executes dropped EXE
                  PID:2604
              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e9531285.exe
                C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e9531285.exe
                4⤵
                • Executes dropped EXE
                PID:4196
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4572 -ip 4572
          1⤵
            PID:2500
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 316 -ip 316
            1⤵
              PID:4108
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 224 -ip 224
              1⤵
                PID:4552
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4908 -ip 4908
                1⤵
                  PID:3856

                Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9570233.exe

                  Filesize

                  1.2MB

                  MD5

                  d462460a319f807a3fbe3495ebbdd171

                  SHA1

                  48ed5fb121a3df061cb7e7d711fd9f423ec4218c

                  SHA256

                  1b039690f5cf8749acd1c454025f4269ef992527eb879cb3dc901f53a18302bb

                  SHA512

                  c5b60604a287a916b53b2b3416a25ce5863da39ac5d7862bf1da3f3c4d771bd484701d254a5a05ce929ef14969ca1b3250c67ea7b546eae55876e975928fa68c

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v9570233.exe

                  Filesize

                  1.2MB

                  MD5

                  d462460a319f807a3fbe3495ebbdd171

                  SHA1

                  48ed5fb121a3df061cb7e7d711fd9f423ec4218c

                  SHA256

                  1b039690f5cf8749acd1c454025f4269ef992527eb879cb3dc901f53a18302bb

                  SHA512

                  c5b60604a287a916b53b2b3416a25ce5863da39ac5d7862bf1da3f3c4d771bd484701d254a5a05ce929ef14969ca1b3250c67ea7b546eae55876e975928fa68c

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4570346.exe

                  Filesize

                  951KB

                  MD5

                  17122edeaa945ab55f7c1750b34bf7d9

                  SHA1

                  9619acfec17581986278b2e9252a47708a1148d1

                  SHA256

                  c4fd5435e871f756fb2a63f92b1e579448d66a01f0e4ab9a32cf0c1da7196e4a

                  SHA512

                  7129c2c73925d67e722161a3058a1d071dc5b8b0d017680bd7ba6186d81f22818ab2caade2e348d09c30a9cb4609561fb73bd93f09cbca79e854ca762a5f87a9

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v4570346.exe

                  Filesize

                  951KB

                  MD5

                  17122edeaa945ab55f7c1750b34bf7d9

                  SHA1

                  9619acfec17581986278b2e9252a47708a1148d1

                  SHA256

                  c4fd5435e871f756fb2a63f92b1e579448d66a01f0e4ab9a32cf0c1da7196e4a

                  SHA512

                  7129c2c73925d67e722161a3058a1d071dc5b8b0d017680bd7ba6186d81f22818ab2caade2e348d09c30a9cb4609561fb73bd93f09cbca79e854ca762a5f87a9

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e9531285.exe

                  Filesize

                  174KB

                  MD5

                  f0e710d9f9332a9339b11fdcf181418d

                  SHA1

                  995d494883e7eb10209b4ae0ab1e2a4981584279

                  SHA256

                  ac9fa06708f93318ea86a4e25a01e1774820d16bd5e59051760b66129ef51ed1

                  SHA512

                  1c6c6ddc670714554ae21bb19e668e321a23e2b78dcd82f079f93ede439d429f83d0657e040180d1f6a690bce77d58f48076506812fa2d36b59e996d3e897a0f

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e9531285.exe

                  Filesize

                  174KB

                  MD5

                  f0e710d9f9332a9339b11fdcf181418d

                  SHA1

                  995d494883e7eb10209b4ae0ab1e2a4981584279

                  SHA256

                  ac9fa06708f93318ea86a4e25a01e1774820d16bd5e59051760b66129ef51ed1

                  SHA512

                  1c6c6ddc670714554ae21bb19e668e321a23e2b78dcd82f079f93ede439d429f83d0657e040180d1f6a690bce77d58f48076506812fa2d36b59e996d3e897a0f

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5987817.exe

                  Filesize

                  797KB

                  MD5

                  215377efce57f806e88da01fadb4e31a

                  SHA1

                  9adbe1a571efa79ced55622e3fe74f2a6406f0b5

                  SHA256

                  538ba012013aa73f6eb0e40b6b3ae563f72336a116b6f87043568dc3eef14dff

                  SHA512

                  a00c9520ccb63f602c160a7937642aec01d0bd9b159cfdf81ba8642827db834a8e84403752f5cca605d5707751b9d4fa1a4e91f98c79d0c20c126533874425c5

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5987817.exe

                  Filesize

                  797KB

                  MD5

                  215377efce57f806e88da01fadb4e31a

                  SHA1

                  9adbe1a571efa79ced55622e3fe74f2a6406f0b5

                  SHA256

                  538ba012013aa73f6eb0e40b6b3ae563f72336a116b6f87043568dc3eef14dff

                  SHA512

                  a00c9520ccb63f602c160a7937642aec01d0bd9b159cfdf81ba8642827db834a8e84403752f5cca605d5707751b9d4fa1a4e91f98c79d0c20c126533874425c5

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d9100147.exe

                  Filesize

                  140KB

                  MD5

                  17df67008f237b4cd33b1d10f7e06fd7

                  SHA1

                  09f873f3831e5301f8f3d98675d15ccbcd593fa0

                  SHA256

                  eee42ebebf7cb0dce5e5ad7e3d039aff5eaf4f2ef56e20f5e0f80bf2a88d6b12

                  SHA512

                  eb5d1879515d858964606f85f7fefb344cee582f456ded56bcfa1187b3e17dcd9beac5dec4b60fa7f7f9f5b17b1e3e289223eb9f7a7488ce62154cef3a120a2c

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d9100147.exe

                  Filesize

                  140KB

                  MD5

                  17df67008f237b4cd33b1d10f7e06fd7

                  SHA1

                  09f873f3831e5301f8f3d98675d15ccbcd593fa0

                  SHA256

                  eee42ebebf7cb0dce5e5ad7e3d039aff5eaf4f2ef56e20f5e0f80bf2a88d6b12

                  SHA512

                  eb5d1879515d858964606f85f7fefb344cee582f456ded56bcfa1187b3e17dcd9beac5dec4b60fa7f7f9f5b17b1e3e289223eb9f7a7488ce62154cef3a120a2c

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8962129.exe

                  Filesize

                  631KB

                  MD5

                  2a9b7e00ba7582d36d08a5cbb6bf94b1

                  SHA1

                  17f01a44de9e0dd1a80a025326afb04eb76bdabd

                  SHA256

                  44f4b8c895f83d772a74ed58d44e27bd6c1209e0f74dc15637c8c33be9a73263

                  SHA512

                  50e4758bf0ff47a2c05ad6b37bc3c696758b990be93ff28637fc1cc488f66fa8eec761bbb6512bc48178a033e27ca6e2d92b365864412f16e13d1be7e51d2ac0

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8962129.exe

                  Filesize

                  631KB

                  MD5

                  2a9b7e00ba7582d36d08a5cbb6bf94b1

                  SHA1

                  17f01a44de9e0dd1a80a025326afb04eb76bdabd

                  SHA256

                  44f4b8c895f83d772a74ed58d44e27bd6c1209e0f74dc15637c8c33be9a73263

                  SHA512

                  50e4758bf0ff47a2c05ad6b37bc3c696758b990be93ff28637fc1cc488f66fa8eec761bbb6512bc48178a033e27ca6e2d92b365864412f16e13d1be7e51d2ac0

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c5497651.exe

                  Filesize

                  413KB

                  MD5

                  7b8c0c048c1aeb5fa0add63db0655d11

                  SHA1

                  925c27e3fc5e7b46d0b96811ae965ffb232af55e

                  SHA256

                  07dd6077ab60fa82c9d3e9cb2fd18bc89063a2d6621e84cb432817aa2d4c6c9b

                  SHA512

                  290bd19c7aae93938a5ccea69111736dc7a622e83311ad09c74654ee782125cc0d4318012adf8257c883235268f113ca0c37f24ca5badf691ebf82db1ffd985d

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c5497651.exe

                  Filesize

                  413KB

                  MD5

                  7b8c0c048c1aeb5fa0add63db0655d11

                  SHA1

                  925c27e3fc5e7b46d0b96811ae965ffb232af55e

                  SHA256

                  07dd6077ab60fa82c9d3e9cb2fd18bc89063a2d6621e84cb432817aa2d4c6c9b

                  SHA512

                  290bd19c7aae93938a5ccea69111736dc7a622e83311ad09c74654ee782125cc0d4318012adf8257c883235268f113ca0c37f24ca5badf691ebf82db1ffd985d

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5390003.exe

                  Filesize

                  354KB

                  MD5

                  29d6ec1f5cd8cf7591eeb3d0347bc941

                  SHA1

                  8f6d27faecb450b0ea816c041cedd15f3b894962

                  SHA256

                  87cf5f41b55ce3fb5f2119fa06ca644f78b2ac93601fe093d7c0947b570a2c15

                  SHA512

                  bfcc01d90e26e292e64a4784037c745315f0facfe5cb878700756fe04d9439732061e74c10c22a9ce50a95771d078e8cb567665ffeebfd30f5824d8c40d11ab1

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5390003.exe

                  Filesize

                  354KB

                  MD5

                  29d6ec1f5cd8cf7591eeb3d0347bc941

                  SHA1

                  8f6d27faecb450b0ea816c041cedd15f3b894962

                  SHA256

                  87cf5f41b55ce3fb5f2119fa06ca644f78b2ac93601fe093d7c0947b570a2c15

                  SHA512

                  bfcc01d90e26e292e64a4784037c745315f0facfe5cb878700756fe04d9439732061e74c10c22a9ce50a95771d078e8cb567665ffeebfd30f5824d8c40d11ab1

                • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2097350.exe

                  Filesize

                  250KB

                  MD5

                  452448317b39902f4778a4c0f9a44b5d

                  SHA1

                  83278921dbb09cb796e55f9981808154a27d206a

                  SHA256

                  acfcce604ff81a8c3862743abd9e0a86c32e44ac14779c592ef7b0371ccb68d6

                  SHA512

                  88a44bc1920ef5ad97e03091f828eada2dc59bb0738d74a2d2dc597ba2390ea70dd137e098280b03849c450671e274dd09b706b9328205c17d25310bb11c64d4

                • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a2097350.exe

                  Filesize

                  250KB

                  MD5

                  452448317b39902f4778a4c0f9a44b5d

                  SHA1

                  83278921dbb09cb796e55f9981808154a27d206a

                  SHA256

                  acfcce604ff81a8c3862743abd9e0a86c32e44ac14779c592ef7b0371ccb68d6

                  SHA512

                  88a44bc1920ef5ad97e03091f828eada2dc59bb0738d74a2d2dc597ba2390ea70dd137e098280b03849c450671e274dd09b706b9328205c17d25310bb11c64d4

                • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b8120067.exe

                  Filesize

                  379KB

                  MD5

                  d0404865182155cea3632a32155b9c3e

                  SHA1

                  12fb297d3fcb516cc50f77d73b711926ec47df54

                  SHA256

                  893315d3e2c85e07ddba004dca0e129640d7e6f6c9a67b8e387ee6f91260e1ba

                  SHA512

                  4763f42fb0ca7f164002253b07d74613a04f1b00ecfea9b8ecd80f7e3a5cfff65efbe8076c5b9672acec57aba4c1c777398f3e99607b338e43d4c0a28d41b7fc

                • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b8120067.exe

                  Filesize

                  379KB

                  MD5

                  d0404865182155cea3632a32155b9c3e

                  SHA1

                  12fb297d3fcb516cc50f77d73b711926ec47df54

                  SHA256

                  893315d3e2c85e07ddba004dca0e129640d7e6f6c9a67b8e387ee6f91260e1ba

                  SHA512

                  4763f42fb0ca7f164002253b07d74613a04f1b00ecfea9b8ecd80f7e3a5cfff65efbe8076c5b9672acec57aba4c1c777398f3e99607b338e43d4c0a28d41b7fc

                • memory/224-51-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/224-49-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/224-48-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/224-47-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/744-55-0x0000000000400000-0x0000000000430000-memory.dmp

                  Filesize

                  192KB

                • memory/744-72-0x0000000002840000-0x000000000288C000-memory.dmp

                  Filesize

                  304KB

                • memory/744-56-0x0000000000C70000-0x0000000000C76000-memory.dmp

                  Filesize

                  24KB

                • memory/744-59-0x0000000005670000-0x0000000005C88000-memory.dmp

                  Filesize

                  6.1MB

                • memory/744-62-0x0000000005160000-0x000000000526A000-memory.dmp

                  Filesize

                  1.0MB

                • memory/744-64-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

                  Filesize

                  64KB

                • memory/744-63-0x0000000000EA0000-0x0000000000EB2000-memory.dmp

                  Filesize

                  72KB

                • memory/744-77-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

                  Filesize

                  64KB

                • memory/744-74-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/744-57-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/744-69-0x0000000002800000-0x000000000283C000-memory.dmp

                  Filesize

                  240KB

                • memory/3416-73-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3416-42-0x0000000000400000-0x000000000040A000-memory.dmp

                  Filesize

                  40KB

                • memory/3416-76-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3416-43-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4196-70-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4196-71-0x0000000002560000-0x0000000002566000-memory.dmp

                  Filesize

                  24KB

                • memory/4196-68-0x0000000000190000-0x00000000001C0000-memory.dmp

                  Filesize

                  192KB

                • memory/4196-78-0x0000000073FC0000-0x0000000074770000-memory.dmp

                  Filesize

                  7.7MB

                • memory/4196-79-0x0000000002570000-0x0000000002580000-memory.dmp

                  Filesize

                  64KB