Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    124s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/05/2024, 03:39

General

  • Target

    68a03989c401935856f83b05945a3981e6f5c945d16d61c79da883c078572329.exe

  • Size

    1.8MB

  • MD5

    ca631405c16e836a9d263c22306ca8fa

  • SHA1

    1d5437fc55fe852ca2ec4e9642d95569204937ec

  • SHA256

    68a03989c401935856f83b05945a3981e6f5c945d16d61c79da883c078572329

  • SHA512

    55b2ed35f71b03bf7a39586d5820cc3f84ba4d10720a05c2beb16e8184bd02877c729a8b3375c7b3526cfd4ac1c521fc37db64d75dfb55886fc4ac8a971f6be0

  • SSDEEP

    24576:6/Sgg64KWKPQQpme9TIOMefZZ/+pdLM6NCi+LNWrJJveXc1G818Jnmi72CNlg1RT:tkWKPQQYsc3efZKTki+L0rnKSKmw6TT

Malware Config

Extracted

Family

amadey

Version

4.20

Botnet

18befc

C2

http://5.42.96.141

Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain

Extracted

Family

amadey

Version

4.20

Botnet

c767c0

C2

http://5.42.96.7

Attributes
  • install_dir

    7af68cdb52

  • install_file

    axplons.exe

  • strings_key

    e2ce58e78f631ed97d01fe7b70e85d5e

  • url_paths

    /zamo7h/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 11 IoCs
  • Identifies Wine through registry keys 2 TTPs 5 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 49 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68a03989c401935856f83b05945a3981e6f5c945d16d61c79da883c078572329.exe
    "C:\Users\Admin\AppData\Local\Temp\68a03989c401935856f83b05945a3981e6f5c945d16d61c79da883c078572329.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:1104
        • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2164
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:608
            • C:\Users\Admin\AppData\Local\Temp\1000064001\123.exe
              "C:\Users\Admin\AppData\Local\Temp\1000064001\123.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:3452
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                  PID:2260
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1636
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\delete.bat" "
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    PID:468
                    • C:\Windows\SysWOW64\PING.EXE
                      ping 127.0.0.1 -n 2
                      8⤵
                      • Runs ping.exe
                      PID:4920
          • C:\Users\Admin\AppData\Local\Temp\1000014001\f65f8841d5.exe
            "C:\Users\Admin\AppData\Local\Temp\1000014001\f65f8841d5.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            PID:4984
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:2376
      • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
        C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3160
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:392
      • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
        C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:3904
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        PID:2844
      • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
        C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        PID:2200

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1000013001\amers.exe

        Filesize

        1.8MB

        MD5

        97aca3e79ee54a3eff17a8ed25bc037d

        SHA1

        9a835971559040f587d8697379fd1e2396c7a3a8

        SHA256

        2b6c606a88c3c7c3d9ced145f43d864dfd307e35da5bc61792c183d54fba29ec

        SHA512

        7ffa1f7e657816c4fc2ca82a6cb149a5ad7e0a1f79ace3814d1deace6152fb5235f866f984a290ce3bf2865574e09d5a966b2e834e34c81d55eb2c7d6c3f62e7

      • C:\Users\Admin\AppData\Local\Temp\1000014001\f65f8841d5.exe

        Filesize

        2.1MB

        MD5

        4fe0572fb9b72ea4504c3e7eea8f095b

        SHA1

        16500f90e4d8eadfc439952ca77643945aa28f4d

        SHA256

        97688097a18e2830bdf987acf0dec418b62ff967b8f3621b54f7d9b11567d0d5

        SHA512

        7480c2d98147b9461803e5ef62e42dfaf8c110b5454edbd4b8d4f50cdb7a762c93f4cce3dd51dd12a0a7246c725268b006f63b02fe9179328ae8053edb43cf5c

      • C:\Users\Admin\AppData\Local\Temp\1000064001\123.exe

        Filesize

        314KB

        MD5

        d1ec6dbbe13ed8451b267702350c12c6

        SHA1

        85137de6a39adaea4593bdeb7145ad55a578b397

        SHA256

        ca8c047625f5cf6483de7787327e9728efbc3cdfabff58ca623a2966f5c15600

        SHA512

        cb56c17fc95f7ddc0ec885e992a7dbf1f9d4fa0890cb5d652fff88c6ec13c2f5f681389415edebfefee0d07d8c5d50af242d13887eaa61a9031908d7d790f750

      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe

        Filesize

        1.8MB

        MD5

        ca631405c16e836a9d263c22306ca8fa

        SHA1

        1d5437fc55fe852ca2ec4e9642d95569204937ec

        SHA256

        68a03989c401935856f83b05945a3981e6f5c945d16d61c79da883c078572329

        SHA512

        55b2ed35f71b03bf7a39586d5820cc3f84ba4d10720a05c2beb16e8184bd02877c729a8b3375c7b3526cfd4ac1c521fc37db64d75dfb55886fc4ac8a971f6be0

      • C:\Users\Admin\AppData\Local\Temp\delete.bat

        Filesize

        154B

        MD5

        fc7814d37c2c33c99754f0872f113bb7

        SHA1

        a0fccd951eb74bce77dfbd69180d7b140a28ba68

        SHA256

        f15bcd8b8a067a2b2785fae54701fe001242e05412e2cf062cb91bd48d912d49

        SHA512

        900e292acf1caeb09755685b5096fb72c2c0fc5f9ae41a63e2dfbee00004bd2ed7be55c223bac3b19b837823add48b6876568f4c69fb407b132b6f46583ebce2

      • memory/392-157-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-160-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-154-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-155-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-150-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-156-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-151-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/392-152-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/608-133-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-143-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-140-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-137-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-135-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-130-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-146-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/608-63-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/1636-107-0x0000000000400000-0x000000000042C000-memory.dmp

        Filesize

        176KB

      • memory/1636-112-0x00000000064B0000-0x0000000006516000-memory.dmp

        Filesize

        408KB

      • memory/1636-111-0x0000000006620000-0x00000000066B2000-memory.dmp

        Filesize

        584KB

      • memory/1636-109-0x00000000059D0000-0x0000000005F76000-memory.dmp

        Filesize

        5.6MB

      • memory/2164-49-0x0000000077BD6000-0x0000000077BD8000-memory.dmp

        Filesize

        8KB

      • memory/2164-48-0x0000000000FC0000-0x000000000148B000-memory.dmp

        Filesize

        4.8MB

      • memory/2164-62-0x0000000000FC0000-0x000000000148B000-memory.dmp

        Filesize

        4.8MB

      • memory/2200-194-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/2200-190-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/2376-116-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-121-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-120-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-117-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-118-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-119-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-114-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2376-123-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/2844-192-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/3160-122-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/3160-124-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/3452-106-0x0000000000C00000-0x0000000000C01000-memory.dmp

        Filesize

        4KB

      • memory/3452-108-0x0000000000C00000-0x0000000000C01000-memory.dmp

        Filesize

        4KB

      • memory/3904-162-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/3904-158-0x00000000004D0000-0x000000000099B000-memory.dmp

        Filesize

        4.8MB

      • memory/4736-2-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-3-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-0-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-22-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-7-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-8-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-6-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-5-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-4-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4736-1-0x0000000000B00000-0x0000000001063000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-28-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-24-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-27-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-110-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-30-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-29-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-25-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-23-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-20-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4964-26-0x0000000000770000-0x0000000000CD3000-memory.dmp

        Filesize

        5.4MB

      • memory/4984-131-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-82-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-85-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-84-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-83-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-87-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-89-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-90-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-88-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB

      • memory/4984-86-0x0000000000190000-0x000000000080B000-memory.dmp

        Filesize

        6.5MB