Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 20:20

General

  • Target

    b212b71c65695cd780eb6b705c0ac1c84a63787a560b167fd44a540a4899ed0f.exe

  • Size

    1.3MB

  • MD5

    d44e688a46beb24b30c62847e08edbba

  • SHA1

    91f3e478935acec36030648fadad6e9a68b23830

  • SHA256

    b212b71c65695cd780eb6b705c0ac1c84a63787a560b167fd44a540a4899ed0f

  • SHA512

    cb3af734945a58a6c8454ec3cf4e64b847536b061b1c99abc0fe355cfb00f0d58dc96b3919c050780d15dd356c051b5d1dbf298625687e35111174d67dac44e2

  • SSDEEP

    24576:GyOkc2+12wEqBrFxtQ2W3bXLhgTxraU4MAvi4j5LXCU:V9cSqBRjEDWWPP1e

Malware Config

Extracted

Family

redline

Botnet

darts

C2

77.91.124.82:19071

Attributes
  • auth_value

    3c8818da7045365845f15ec0946ebf11

Extracted

Family

redline

Botnet

kendo

C2

77.91.124.82:19071

Attributes
  • auth_value

    5a22a881561d49941415902859b51f14

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Executes dropped EXE 10 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b212b71c65695cd780eb6b705c0ac1c84a63787a560b167fd44a540a4899ed0f.exe
    "C:\Users\Admin\AppData\Local\Temp\b212b71c65695cd780eb6b705c0ac1c84a63787a560b167fd44a540a4899ed0f.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4300
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1467628.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1467628.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4052
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5231883.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5231883.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3468
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5167052.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5167052.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8915469.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8915469.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:4856
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5694997.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5694997.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:1740
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a4816700.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a4816700.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1140
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3036
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1140 -s 552
                  8⤵
                  • Program crash
                  PID:3480
              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3148706.exe
                C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3148706.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1568
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  8⤵
                    PID:3644
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 540
                      9⤵
                      • Program crash
                      PID:4952
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 552
                    8⤵
                    • Program crash
                    PID:4488
              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c0915780.exe
                C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c0915780.exe
                6⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:580
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  7⤵
                    PID:2684
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 552
                    7⤵
                    • Program crash
                    PID:3716
              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d6925164.exe
                C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d6925164.exe
                5⤵
                • Executes dropped EXE
                PID:4936
            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3632090.exe
              C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3632090.exe
              4⤵
              • Executes dropped EXE
              PID:2588
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1140 -ip 1140
        1⤵
          PID:5044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1568 -ip 1568
          1⤵
            PID:3420
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3644 -ip 3644
            1⤵
              PID:3820
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 580 -ip 580
              1⤵
                PID:2980

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

                Filesize

                226B

                MD5

                916851e072fbabc4796d8916c5131092

                SHA1

                d48a602229a690c512d5fdaf4c8d77547a88e7a2

                SHA256

                7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

                SHA512

                07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1467628.exe

                Filesize

                1.2MB

                MD5

                48f37853251426d2e0188ed2031e7279

                SHA1

                ef685a627166daaa504537416472880ca1cd18ee

                SHA256

                a415f72403c803baa59103b33f13cb5c6c1f9d7bb5aa0cca4d952d9314f66256

                SHA512

                3ee45724a9b486804ccaa84ae3cf4cc14c81f956951ce034dad294ce52ff745d66429de2afa1a03f04a2727b10b2a45d420af053aa7ae76f1b02ef28de58fbfa

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1467628.exe

                Filesize

                1.2MB

                MD5

                48f37853251426d2e0188ed2031e7279

                SHA1

                ef685a627166daaa504537416472880ca1cd18ee

                SHA256

                a415f72403c803baa59103b33f13cb5c6c1f9d7bb5aa0cca4d952d9314f66256

                SHA512

                3ee45724a9b486804ccaa84ae3cf4cc14c81f956951ce034dad294ce52ff745d66429de2afa1a03f04a2727b10b2a45d420af053aa7ae76f1b02ef28de58fbfa

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5231883.exe

                Filesize

                947KB

                MD5

                3e8f2197b22e862554286172d05723b4

                SHA1

                4bc3d749a23e83adcf063e58f5738c8f97c1288d

                SHA256

                1b706c9b265504acb6e7783f70e02dd7a222a851391e2b137d6739ab9db04d3f

                SHA512

                fd2bf2ee03d49c770f03335bd5ecc8a41c32ad7d588e3dc45c649ccabd676be1596e05b6f52b9e3532868ec92c336de6b0cdd6136bb361484f20fa3309ab9726

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v5231883.exe

                Filesize

                947KB

                MD5

                3e8f2197b22e862554286172d05723b4

                SHA1

                4bc3d749a23e83adcf063e58f5738c8f97c1288d

                SHA256

                1b706c9b265504acb6e7783f70e02dd7a222a851391e2b137d6739ab9db04d3f

                SHA512

                fd2bf2ee03d49c770f03335bd5ecc8a41c32ad7d588e3dc45c649ccabd676be1596e05b6f52b9e3532868ec92c336de6b0cdd6136bb361484f20fa3309ab9726

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3632090.exe

                Filesize

                173KB

                MD5

                3df7bccaee4344c0bf268b31ac99bdee

                SHA1

                30fa7b31fac61929dbf9f52cdd319056db6a8592

                SHA256

                0ac855108534a4a7d5329520c5f3782689d0e2e3c8238d9c23cc050185a02391

                SHA512

                cebfa94cd39e2e3997d31ad7061a331c3fc4b0e38bd4dfd8d19b6a07856cfe790f1a3b10392f4cea39505728bf25a481e36390af1921ff8a01729b66de289928

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\e3632090.exe

                Filesize

                173KB

                MD5

                3df7bccaee4344c0bf268b31ac99bdee

                SHA1

                30fa7b31fac61929dbf9f52cdd319056db6a8592

                SHA256

                0ac855108534a4a7d5329520c5f3782689d0e2e3c8238d9c23cc050185a02391

                SHA512

                cebfa94cd39e2e3997d31ad7061a331c3fc4b0e38bd4dfd8d19b6a07856cfe790f1a3b10392f4cea39505728bf25a481e36390af1921ff8a01729b66de289928

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5167052.exe

                Filesize

                790KB

                MD5

                23e5080873147fe51c61031fe1d96670

                SHA1

                a243c33396bf1509fa42692b09e6e210f296f64b

                SHA256

                5dbeef7d027ae143c18e35e69d4f90a86e64e9fa470ef990d9f176881e295aab

                SHA512

                3f5c03d4de84c7772eba3d2700b8d135f9d1aafc867a88b9acf4415f2d3ff7040a0a3664ec72c7325b376a2d5264c1123b7c4e404afd37a20a030e33d4cc963f

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5167052.exe

                Filesize

                790KB

                MD5

                23e5080873147fe51c61031fe1d96670

                SHA1

                a243c33396bf1509fa42692b09e6e210f296f64b

                SHA256

                5dbeef7d027ae143c18e35e69d4f90a86e64e9fa470ef990d9f176881e295aab

                SHA512

                3f5c03d4de84c7772eba3d2700b8d135f9d1aafc867a88b9acf4415f2d3ff7040a0a3664ec72c7325b376a2d5264c1123b7c4e404afd37a20a030e33d4cc963f

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d6925164.exe

                Filesize

                140KB

                MD5

                6b13bc4b5aa4b94c9adb96fcfb28d03b

                SHA1

                e4e2d10bf4f350f32a0f1fd09a9695c98b5142bc

                SHA256

                5b76e33c7388c2c4802fce53c418c77ad3a6144ff2b2872d7cf12e8a44698fb3

                SHA512

                90fa67479c514a57643ecaec71617789382af94bd6f03b9b22530e77a6de2f47488a9a8abb310d186aaad5315a6c33e15244957e75eea06f6a7226e3a9a24e6c

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\d6925164.exe

                Filesize

                140KB

                MD5

                6b13bc4b5aa4b94c9adb96fcfb28d03b

                SHA1

                e4e2d10bf4f350f32a0f1fd09a9695c98b5142bc

                SHA256

                5b76e33c7388c2c4802fce53c418c77ad3a6144ff2b2872d7cf12e8a44698fb3

                SHA512

                90fa67479c514a57643ecaec71617789382af94bd6f03b9b22530e77a6de2f47488a9a8abb310d186aaad5315a6c33e15244957e75eea06f6a7226e3a9a24e6c

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8915469.exe

                Filesize

                624KB

                MD5

                1a0200e90d5cb905755dc78ac8b40382

                SHA1

                12bff2e6d63fa0fa14e5cd3205495a3cced28b40

                SHA256

                189522ff87c4ca196046c7a6a44af2d8b884e05e14347c53b7f97d9b72b9d660

                SHA512

                becc07d7782532499d2c763209817b326bf7a6b25f2acf8bccc9131e1afdd25054647b44a227d037d1b78a77abec9a864fdf3ea752802c71fa2943ee13e62446

              • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v8915469.exe

                Filesize

                624KB

                MD5

                1a0200e90d5cb905755dc78ac8b40382

                SHA1

                12bff2e6d63fa0fa14e5cd3205495a3cced28b40

                SHA256

                189522ff87c4ca196046c7a6a44af2d8b884e05e14347c53b7f97d9b72b9d660

                SHA512

                becc07d7782532499d2c763209817b326bf7a6b25f2acf8bccc9131e1afdd25054647b44a227d037d1b78a77abec9a864fdf3ea752802c71fa2943ee13e62446

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c0915780.exe

                Filesize

                414KB

                MD5

                cded8fba3f9d2151b02ff4f1478d780f

                SHA1

                b557b3da8bbfd438652c00f0a65a276a0f65d6e6

                SHA256

                fd99b3ea6dae54b3642858cfcf80ec7b13d0eec5941a13045f13fd8a92033f0d

                SHA512

                ed6c038f098daca14098b3ca8200f12dc2f7326971cd2921cf545435631716befe789538c173556b30cf3030a89c94f0d6096269b1732a326bb259c2afbdf792

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\c0915780.exe

                Filesize

                414KB

                MD5

                cded8fba3f9d2151b02ff4f1478d780f

                SHA1

                b557b3da8bbfd438652c00f0a65a276a0f65d6e6

                SHA256

                fd99b3ea6dae54b3642858cfcf80ec7b13d0eec5941a13045f13fd8a92033f0d

                SHA512

                ed6c038f098daca14098b3ca8200f12dc2f7326971cd2921cf545435631716befe789538c173556b30cf3030a89c94f0d6096269b1732a326bb259c2afbdf792

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5694997.exe

                Filesize

                350KB

                MD5

                ec107e5ead6d0f9c123e193365922142

                SHA1

                be8ac7b4c96358195f06c86e4b4d34b566b44fb4

                SHA256

                de16677a36e3b1fd53d248422433722cf0a91b9f28f75d33b5919bab5ad67762

                SHA512

                1b3d781f5f8b6701d3540b97402b524d673991c7657d5b85657237b8ee99581e00f0f40cd3abb62ca157abcae78f8ac28d4c5d0e22c8611ae4cc901920e7c6da

              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\v5694997.exe

                Filesize

                350KB

                MD5

                ec107e5ead6d0f9c123e193365922142

                SHA1

                be8ac7b4c96358195f06c86e4b4d34b566b44fb4

                SHA256

                de16677a36e3b1fd53d248422433722cf0a91b9f28f75d33b5919bab5ad67762

                SHA512

                1b3d781f5f8b6701d3540b97402b524d673991c7657d5b85657237b8ee99581e00f0f40cd3abb62ca157abcae78f8ac28d4c5d0e22c8611ae4cc901920e7c6da

              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a4816700.exe

                Filesize

                251KB

                MD5

                947ed64f7d2c5ee553dd9aedf857b7c0

                SHA1

                c8e6ec57b84bd0d21b34f31bdfe64b454f859970

                SHA256

                e79fc4f22a46761e553211bed7f1db1c2afa379205b3a1e78df04b2ee1af2e5c

                SHA512

                1acd869c28c5bdb13630f54afadf0b30a88c2f41ddc254f56cfbd7f0d3d51f2479fdf9f26a6bffa44a7657ac3d2e9f9a0319c015594eb0db50c9ee1d3d48121a

              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\a4816700.exe

                Filesize

                251KB

                MD5

                947ed64f7d2c5ee553dd9aedf857b7c0

                SHA1

                c8e6ec57b84bd0d21b34f31bdfe64b454f859970

                SHA256

                e79fc4f22a46761e553211bed7f1db1c2afa379205b3a1e78df04b2ee1af2e5c

                SHA512

                1acd869c28c5bdb13630f54afadf0b30a88c2f41ddc254f56cfbd7f0d3d51f2479fdf9f26a6bffa44a7657ac3d2e9f9a0319c015594eb0db50c9ee1d3d48121a

              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3148706.exe

                Filesize

                380KB

                MD5

                f7b597a9f253abb1f32fe103083ad0e9

                SHA1

                80d4ea4d5cc1ff39c49e3dc5e59b9c03667fd298

                SHA256

                a643dd4c075aa84aa622f7ef105fcb68c23375c032e5870fffda91a3bc9a7464

                SHA512

                24c04540d77ac9dcc5d3b434af43b2ae454ad4029257ffdcd9e6f70dc112f9182eea9166f81eb81fb6dabf2dd9396d4d4d1b1548138a90026c845d68f36f4682

              • C:\Users\Admin\AppData\Local\Temp\IXP005.TMP\b3148706.exe

                Filesize

                380KB

                MD5

                f7b597a9f253abb1f32fe103083ad0e9

                SHA1

                80d4ea4d5cc1ff39c49e3dc5e59b9c03667fd298

                SHA256

                a643dd4c075aa84aa622f7ef105fcb68c23375c032e5870fffda91a3bc9a7464

                SHA512

                24c04540d77ac9dcc5d3b434af43b2ae454ad4029257ffdcd9e6f70dc112f9182eea9166f81eb81fb6dabf2dd9396d4d4d1b1548138a90026c845d68f36f4682

              • memory/2588-69-0x0000000000400000-0x0000000000430000-memory.dmp

                Filesize

                192KB

              • memory/2588-78-0x0000000073660000-0x0000000073E10000-memory.dmp

                Filesize

                7.7MB

              • memory/2588-75-0x0000000004E00000-0x0000000004E3C000-memory.dmp

                Filesize

                240KB

              • memory/2588-70-0x0000000073660000-0x0000000073E10000-memory.dmp

                Filesize

                7.7MB

              • memory/2588-71-0x0000000002640000-0x0000000002646000-memory.dmp

                Filesize

                24KB

              • memory/2684-74-0x00000000055A0000-0x00000000055B0000-memory.dmp

                Filesize

                64KB

              • memory/2684-60-0x0000000073660000-0x0000000073E10000-memory.dmp

                Filesize

                7.7MB

              • memory/2684-77-0x0000000073660000-0x0000000073E10000-memory.dmp

                Filesize

                7.7MB

              • memory/2684-73-0x0000000005530000-0x0000000005542000-memory.dmp

                Filesize

                72KB

              • memory/2684-65-0x0000000005CD0000-0x00000000062E8000-memory.dmp

                Filesize

                6.1MB

              • memory/2684-79-0x00000000055A0000-0x00000000055B0000-memory.dmp

                Filesize

                64KB

              • memory/2684-72-0x00000000057C0000-0x00000000058CA000-memory.dmp

                Filesize

                1.0MB

              • memory/2684-76-0x00000000056F0000-0x000000000573C000-memory.dmp

                Filesize

                304KB

              • memory/2684-58-0x0000000000400000-0x0000000000430000-memory.dmp

                Filesize

                192KB

              • memory/2684-61-0x0000000002F40000-0x0000000002F46000-memory.dmp

                Filesize

                24KB

              • memory/3036-42-0x0000000000400000-0x000000000040A000-memory.dmp

                Filesize

                40KB

              • memory/3036-43-0x0000000074400000-0x0000000074BB0000-memory.dmp

                Filesize

                7.7MB

              • memory/3036-44-0x0000000074400000-0x0000000074BB0000-memory.dmp

                Filesize

                7.7MB

              • memory/3036-46-0x0000000074400000-0x0000000074BB0000-memory.dmp

                Filesize

                7.7MB

              • memory/3644-50-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/3644-54-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/3644-52-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB

              • memory/3644-51-0x0000000000400000-0x0000000000428000-memory.dmp

                Filesize

                160KB