Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 03:21

General

  • Target

    NEAS.e358b45fd5d749157a0dab83f8487130.exe

  • Size

    400KB

  • MD5

    e358b45fd5d749157a0dab83f8487130

  • SHA1

    761d0d798b508382d03d6d6bf3282020969c085f

  • SHA256

    980b0532bf7508e78c9ace1ef315105a76ed8dfd6f19d0417c5116cbe94c0fc3

  • SHA512

    5fbe898d6b5836a07bf8fcfed9601f51991275cc5f23690f43c98560a93a89f1942fa0dba39f1a7953afd155e1c68a7b55a90da4e230df797a8e8079c4753c54

  • SSDEEP

    6144:KVy+bnr+Bp0yN90QElMw4UFYvVSlvUdgqA5OLQJHNRjX3a41KSnThPCOgy:PMrVy90/4UF3viS5OL43XKHS9Chy

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.e358b45fd5d749157a0dab83f8487130.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.e358b45fd5d749157a0dab83f8487130.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bd934uq.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bd934uq.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4960
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
          PID:1284
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1284 -s 540
            4⤵
            • Program crash
            PID:3956
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Lg4CB6.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Lg4CB6.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1752
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          3⤵
            PID:4796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1284 -ip 1284
        1⤵
          PID:3660

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bd934uq.exe

          Filesize

          319KB

          MD5

          4a868c16482f0ab8800d3f1eff627a9b

          SHA1

          c4527bdfb9929627534ca2299d858757e243bbe2

          SHA256

          bda2de9cf44b5c317144c8eef0e229740fda2b537e8c233c1d2117c6942ac3ee

          SHA512

          cc1cfeb3591ecb3d48783f5710dc0bbbe03273f778cec76ba42eb3194f6f8b84e100f73b8ba4fdab49c1c626ac73006de62d327ec5759c0015e1895456f12f10

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bd934uq.exe

          Filesize

          319KB

          MD5

          4a868c16482f0ab8800d3f1eff627a9b

          SHA1

          c4527bdfb9929627534ca2299d858757e243bbe2

          SHA256

          bda2de9cf44b5c317144c8eef0e229740fda2b537e8c233c1d2117c6942ac3ee

          SHA512

          cc1cfeb3591ecb3d48783f5710dc0bbbe03273f778cec76ba42eb3194f6f8b84e100f73b8ba4fdab49c1c626ac73006de62d327ec5759c0015e1895456f12f10

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Lg4CB6.exe

          Filesize

          358KB

          MD5

          208775d53d5962c2646324462f33c659

          SHA1

          fe220fbe4b9ee76e2f16d3612893c163136ece4e

          SHA256

          7825250a68803aaab13abd864eeb95573ada5acc6605b25239eee1dbbd0ba42c

          SHA512

          d346cf7ac9d69acceb7a72b4ea1834432eb906cb93217e2b5213fedfd0664c8069e62c72c69a96e3f866e84cfd68545ccf594d269079b86bb0b3fa1f152403fe

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4Lg4CB6.exe

          Filesize

          358KB

          MD5

          208775d53d5962c2646324462f33c659

          SHA1

          fe220fbe4b9ee76e2f16d3612893c163136ece4e

          SHA256

          7825250a68803aaab13abd864eeb95573ada5acc6605b25239eee1dbbd0ba42c

          SHA512

          d346cf7ac9d69acceb7a72b4ea1834432eb906cb93217e2b5213fedfd0664c8069e62c72c69a96e3f866e84cfd68545ccf594d269079b86bb0b3fa1f152403fe

        • memory/1284-7-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/1284-9-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/1284-11-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/1284-8-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/4796-17-0x0000000008040000-0x00000000085E4000-memory.dmp

          Filesize

          5.6MB

        • memory/4796-16-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/4796-15-0x0000000000400000-0x000000000043C000-memory.dmp

          Filesize

          240KB

        • memory/4796-18-0x0000000007B50000-0x0000000007BE2000-memory.dmp

          Filesize

          584KB

        • memory/4796-19-0x0000000074080000-0x0000000074830000-memory.dmp

          Filesize

          7.7MB

        • memory/4796-20-0x0000000007C80000-0x0000000007C90000-memory.dmp

          Filesize

          64KB

        • memory/4796-21-0x0000000007C20000-0x0000000007C2A000-memory.dmp

          Filesize

          40KB

        • memory/4796-22-0x0000000008C10000-0x0000000009228000-memory.dmp

          Filesize

          6.1MB

        • memory/4796-23-0x0000000007EC0000-0x0000000007FCA000-memory.dmp

          Filesize

          1.0MB

        • memory/4796-24-0x0000000007DF0000-0x0000000007E02000-memory.dmp

          Filesize

          72KB

        • memory/4796-25-0x0000000007E50000-0x0000000007E8C000-memory.dmp

          Filesize

          240KB

        • memory/4796-26-0x0000000007FD0000-0x000000000801C000-memory.dmp

          Filesize

          304KB

        • memory/4796-27-0x0000000007C80000-0x0000000007C90000-memory.dmp

          Filesize

          64KB