Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 11:12

General

  • Target

    c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe

  • Size

    515KB

  • MD5

    9b8021b570f8537a35e6473425712c56

  • SHA1

    7705fbc7332b2945c16d51929584bbdce269f6e6

  • SHA256

    c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30

  • SHA512

    d84bf9600a08d87179230da9fa4655fbe0dfcfd4667eb19ac5d26ac9850f8920a81ad2c93e1859ee1841e0353bd7b339c671608211dc145effb731bd1b994247

  • SSDEEP

    12288:kMr8y90/KKxfRPj6YJEv/IxjywHcI5kbhvfLoG0Ql2fQfz:4y6G/sjAYih0K2Qz

Malware Config

Extracted

Family

amadey

Version

3.85

C2

http://77.91.68.3

Attributes
  • install_dir

    3ec1f323b5

  • install_file

    danke.exe

  • strings_key

    827021be90f1e85ab27949ea7e9347e8

  • url_paths

    /home/love/index.php

rc4.plain

Extracted

Family

redline

Botnet

grom

C2

77.91.68.68:19071

Attributes
  • auth_value

    9ec3129bff410b89097d656d7abc33dc

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe
    "C:\Users\Admin\AppData\Local\Temp\c4490bf8834c5c3594355b47c30aba72c7684a25e0614f1a74add9993af97f30.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2400
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3196
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1456
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2220
          • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
            "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4656
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN danke.exe /TR "C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe" /F
              6⤵
              • Creates scheduled task(s)
              PID:816
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "danke.exe" /P "Admin:N"&&CACLS "danke.exe" /P "Admin:R" /E&&echo Y|CACLS "..\3ec1f323b5" /P "Admin:N"&&CACLS "..\3ec1f323b5" /P "Admin:R" /E&&Exit
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:3616
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                7⤵
                  PID:3596
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "danke.exe" /P "Admin:N"
                  7⤵
                    PID:4016
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "danke.exe" /P "Admin:R" /E
                    7⤵
                      PID:3944
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                      7⤵
                        PID:4596
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\3ec1f323b5" /P "Admin:N"
                        7⤵
                          PID:4188
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\3ec1f323b5" /P "Admin:R" /E
                          7⤵
                            PID:3464
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe
                    3⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    PID:2840
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1376
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:1272
              • C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                C:\Users\Admin\AppData\Local\Temp\3ec1f323b5\danke.exe
                1⤵
                • Executes dropped EXE
                PID:2900

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\d3796674.exe

                Filesize

                172KB

                MD5

                8358cb2d3f34962fc91719d288c15e8b

                SHA1

                9c16e75f8f7ed88411166d0b2b8bb3449c29194f

                SHA256

                eeb937d59976fbd8e84eb2467d322cc7f7a023792d64d5efd9fd73f6f86d5579

                SHA512

                fcb8a872a7ec7deddcfd527736089a2b1d38199394eaa107d34ed95e8576d83f3baf000c355542e7f6433e903709fc7d70188ac96feac7bdfce348820efe45e8

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v3919422.exe

                Filesize

                359KB

                MD5

                1acae507d505295617d1d9e35e7ff325

                SHA1

                5a51d767e542eb063cad3c1a1941eacd79c5615f

                SHA256

                9650beff753142aee81cebf4cea8713c3082ebadbc85da42918cbbef073a6100

                SHA512

                64d960be85e8cdee0f34a077fab0b1f30df25834a2bf95d746de407caa193fcaa1ad27582d64b9056c718da2f040b5ee4472d6be025db729b265eab9ca0153d3

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\c7654671.exe

                Filesize

                33KB

                MD5

                de08a9da7e87ccd216528a8af6a17ae7

                SHA1

                acd05b906646ae038db6a14d161ea5944f0a7d74

                SHA256

                11fb638def845950f74c9ef33f6efc5c21e23523253641015cc9fb9fd9d51c01

                SHA512

                296f79f1a902fba21955d625e47a7d422a916b5511105c0e68e04f3917dc2d9939aceb0679b97ca0f89cd02154b441c240cca9f23927dc9f4e5b7bc9aa606892

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v6386104.exe

                Filesize

                235KB

                MD5

                bbb9f75f658955c74b106491947e7515

                SHA1

                eb2095b2e7fe352c81bebf76163f338e729c4e7c

                SHA256

                1a64590efa05eaf5cdbf115ea5865adc8b36d3d7b190276dbf82f92fdb8c525d

                SHA512

                f2cd98b8e757b0f66ccbc09f6823f9b36ac03eb8539d78bbfb026d7f353eda55f8b8df6f64932b0a3b070705a1d9dec722b31caddaa942c107d810682b430053

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\a6374392.exe

                Filesize

                16KB

                MD5

                548c2b9bf640901f69dbebe16314c8e3

                SHA1

                117bb6831e7b0ccf87eb362839cc01edec17b0f9

                SHA256

                657b1e6fc8c9a038b6cfeea43a3fb4750850733150359938e410812b33d07bd1

                SHA512

                4e8198b8e48c589e81dd1d0f63639cf1b9a0e83ee52c707c4ed0ce068393f2e5386d82509cb306894c34ae5e4413e66886d09ca06c5e86ad5443f3e90fa523c9

              • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\b3417358.exe

                Filesize

                228KB

                MD5

                c57d8839d9005c5ee82c1c9423470c60

                SHA1

                5f5db7ad592e1e58af4a7cac6da93bcea6b782e6

                SHA256

                304e1585904538f133c315e7f96e2b47b018e8b3dc968d489a6abf1ff61de0ab

                SHA512

                84a7427b6ab249ec1a0075fb4c6251c4c37b408d528836b570c9199a32c0bf3769e3aab12833aef1e80af52e83ab06f2367ec7b44ad9f3f6bdf8d6d9c2ace0d5

              • memory/1376-47-0x000000000AF80000-0x000000000B08A000-memory.dmp

                Filesize

                1.0MB

              • memory/1376-44-0x0000000000FB0000-0x0000000000FE0000-memory.dmp

                Filesize

                192KB

              • memory/1376-45-0x0000000003380000-0x0000000003386000-memory.dmp

                Filesize

                24KB

              • memory/1376-46-0x000000000B490000-0x000000000BAA8000-memory.dmp

                Filesize

                6.1MB

              • memory/1376-48-0x000000000AEA0000-0x000000000AEB2000-memory.dmp

                Filesize

                72KB

              • memory/1376-49-0x000000000AF00000-0x000000000AF3C000-memory.dmp

                Filesize

                240KB

              • memory/1376-50-0x0000000003260000-0x00000000032AC000-memory.dmp

                Filesize

                304KB

              • memory/1456-22-0x0000000000360000-0x000000000036A000-memory.dmp

                Filesize

                40KB

              • memory/1456-21-0x00007FF9FF2E3000-0x00007FF9FF2E5000-memory.dmp

                Filesize

                8KB

              • memory/2840-40-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB