Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    136s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2023, 21:41

General

  • Target

    NEAS.d57c570e6aa9b0c20fdbeb08c0cbf750.exe

  • Size

    892KB

  • MD5

    d57c570e6aa9b0c20fdbeb08c0cbf750

  • SHA1

    71be60159d0fb44ccc88d3562f1c575fadf486fd

  • SHA256

    ca6fb1056ad147526c05d64ff88ef7d6b904c5d1e70eca73dfc446ef3c6586d0

  • SHA512

    9b42d68bf80329af9d7cd5c3d66128035e0fa7fc3dda5d614a88a74dab0a47dceff06be684b37d696121a3ff7f48b6d7b4e362fa37516ebd5649c57ca71a6424

  • SSDEEP

    24576:hyNxCHPsDCH4Kxumk3y+B69hVOjT+TeLPpoJYLh:UNxSPssvEaOjaTe7poJYL

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.d57c570e6aa9b0c20fdbeb08c0cbf750.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.d57c570e6aa9b0c20fdbeb08c0cbf750.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GX3HD35.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GX3HD35.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1436
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11lo5072.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11lo5072.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3504
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
            PID:3048
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 540
              5⤵
              • Program crash
              PID:3076
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12lo907.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12lo907.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
              PID:1348
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13Jf695.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13Jf695.exe
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1552
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            3⤵
              PID:2664
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 836
                4⤵
                • Program crash
                PID:4136
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3048 -ip 3048
          1⤵
            PID:3740
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2664 -ip 2664
            1⤵
              PID:3844

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13Jf695.exe

              Filesize

              724KB

              MD5

              49f9f4cee637c34c465b115a14b87865

              SHA1

              72d061aca36b36374b91fa8ba439714dbeb73c81

              SHA256

              796003d5f397f6471e7309573b1bcdb7e9a2dce5fb9cab17a8ad4217d1a206c2

              SHA512

              f08491e6e5a3b1319f389aabbeb7f15839efd25ebf8c496a10aa832eaaea39e32e7c3f5db8bb6cdbbb01f373724ef590827ac7561d4b7dbd94ad16a333dccb9f

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13Jf695.exe

              Filesize

              724KB

              MD5

              49f9f4cee637c34c465b115a14b87865

              SHA1

              72d061aca36b36374b91fa8ba439714dbeb73c81

              SHA256

              796003d5f397f6471e7309573b1bcdb7e9a2dce5fb9cab17a8ad4217d1a206c2

              SHA512

              f08491e6e5a3b1319f389aabbeb7f15839efd25ebf8c496a10aa832eaaea39e32e7c3f5db8bb6cdbbb01f373724ef590827ac7561d4b7dbd94ad16a333dccb9f

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GX3HD35.exe

              Filesize

              429KB

              MD5

              ce0e6a138ee8ef0942da1936b3642185

              SHA1

              8f07ef80b0e26b4e3e070809d3d6caf4355d3c2e

              SHA256

              ec0e29d31f75f0a3f22112e482d5049d170c879d6381d26c858fbf7e89e03c76

              SHA512

              febdd9cca1c8a42e597552be43ccf8f383dd92925218553c3a0fb4b163e8bc8cf6ab31c737bc5f91f66eabd7496a08b86375c9e8a5d7b2a3f37f2aaebe714cc1

            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\GX3HD35.exe

              Filesize

              429KB

              MD5

              ce0e6a138ee8ef0942da1936b3642185

              SHA1

              8f07ef80b0e26b4e3e070809d3d6caf4355d3c2e

              SHA256

              ec0e29d31f75f0a3f22112e482d5049d170c879d6381d26c858fbf7e89e03c76

              SHA512

              febdd9cca1c8a42e597552be43ccf8f383dd92925218553c3a0fb4b163e8bc8cf6ab31c737bc5f91f66eabd7496a08b86375c9e8a5d7b2a3f37f2aaebe714cc1

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11lo5072.exe

              Filesize

              376KB

              MD5

              27ff8023ab2e4844bca26c500eae93a4

              SHA1

              e418153a0320318be84968ec7aefd2a0a77b932b

              SHA256

              903227849f6b4f4f4d1f010d669737afe3cc16d3a2ee18fe0c546313157a7ffc

              SHA512

              3549ab856a4a5f74f93c8924f031cc22ec6bfc6c4adc60e4c0a134d78a79f948a95ce805826b54f12737bfc6bf3f693e6c7d6e08bef3f9fb50fbe17c9231b8f3

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11lo5072.exe

              Filesize

              376KB

              MD5

              27ff8023ab2e4844bca26c500eae93a4

              SHA1

              e418153a0320318be84968ec7aefd2a0a77b932b

              SHA256

              903227849f6b4f4f4d1f010d669737afe3cc16d3a2ee18fe0c546313157a7ffc

              SHA512

              3549ab856a4a5f74f93c8924f031cc22ec6bfc6c4adc60e4c0a134d78a79f948a95ce805826b54f12737bfc6bf3f693e6c7d6e08bef3f9fb50fbe17c9231b8f3

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12lo907.exe

              Filesize

              415KB

              MD5

              abf76ce4c637da4efb89f7a1d3daff9e

              SHA1

              467f43125cb273a652eee490df1d5ad7e1b23d27

              SHA256

              64231a0767c941ef1de7bfd9bfbd78963831bdeafac7400b712a9bd48a34b94b

              SHA512

              51ac3edfa8ea1bbd2044040f0b661b69b165cd41c32ae4e64ef14ca318ba4d55f38b3283ce72095fdb3fd823210324ec9f0e3a85a504c0884bcd56b84eecc23d

            • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12lo907.exe

              Filesize

              415KB

              MD5

              abf76ce4c637da4efb89f7a1d3daff9e

              SHA1

              467f43125cb273a652eee490df1d5ad7e1b23d27

              SHA256

              64231a0767c941ef1de7bfd9bfbd78963831bdeafac7400b712a9bd48a34b94b

              SHA512

              51ac3edfa8ea1bbd2044040f0b661b69b165cd41c32ae4e64ef14ca318ba4d55f38b3283ce72095fdb3fd823210324ec9f0e3a85a504c0884bcd56b84eecc23d

            • memory/1348-34-0x0000000007B50000-0x0000000007B8C000-memory.dmp

              Filesize

              240KB

            • memory/1348-32-0x0000000007BD0000-0x0000000007CDA000-memory.dmp

              Filesize

              1.0MB

            • memory/1348-22-0x0000000000400000-0x000000000043C000-memory.dmp

              Filesize

              240KB

            • memory/1348-37-0x00000000079C0000-0x00000000079D0000-memory.dmp

              Filesize

              64KB

            • memory/1348-36-0x0000000073FA0000-0x0000000074750000-memory.dmp

              Filesize

              7.7MB

            • memory/1348-26-0x0000000073FA0000-0x0000000074750000-memory.dmp

              Filesize

              7.7MB

            • memory/1348-27-0x0000000007E00000-0x00000000083A4000-memory.dmp

              Filesize

              5.6MB

            • memory/1348-28-0x0000000007850000-0x00000000078E2000-memory.dmp

              Filesize

              584KB

            • memory/1348-29-0x00000000079C0000-0x00000000079D0000-memory.dmp

              Filesize

              64KB

            • memory/1348-30-0x0000000007910000-0x000000000791A000-memory.dmp

              Filesize

              40KB

            • memory/1348-31-0x00000000089D0000-0x0000000008FE8000-memory.dmp

              Filesize

              6.1MB

            • memory/1348-35-0x0000000007CE0000-0x0000000007D2C000-memory.dmp

              Filesize

              304KB

            • memory/1348-33-0x0000000007AF0000-0x0000000007B02000-memory.dmp

              Filesize

              72KB

            • memory/2664-38-0x0000000000400000-0x0000000000488000-memory.dmp

              Filesize

              544KB

            • memory/2664-39-0x0000000000400000-0x0000000000488000-memory.dmp

              Filesize

              544KB

            • memory/2664-40-0x0000000000400000-0x0000000000488000-memory.dmp

              Filesize

              544KB

            • memory/2664-42-0x0000000000400000-0x0000000000488000-memory.dmp

              Filesize

              544KB

            • memory/3048-14-0x0000000000400000-0x0000000000433000-memory.dmp

              Filesize

              204KB

            • memory/3048-20-0x0000000000400000-0x0000000000433000-memory.dmp

              Filesize

              204KB

            • memory/3048-17-0x0000000000400000-0x0000000000433000-memory.dmp

              Filesize

              204KB

            • memory/3048-18-0x0000000000400000-0x0000000000433000-memory.dmp

              Filesize

              204KB