Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 18:50 UTC

General

  • Target

    5bc4a6b3d5d850441455c1201b411fa16528c9d21a13517fd2f373d1536d57f6.exe

  • Size

    812KB

  • MD5

    659d8ade6c93a41292e60a3cf24aee6d

  • SHA1

    57c08365cbed71bef5b3ff3f38fc45354f8bb7bf

  • SHA256

    5bc4a6b3d5d850441455c1201b411fa16528c9d21a13517fd2f373d1536d57f6

  • SHA512

    e29e7ee9dc4482c300081c2cba82f48332b6e5b425d8e99c24f8f2e1d265353d014bf23d05787a55db862bda8d424aae5bb85058cc376735065f3a7822c0244a

  • SSDEEP

    12288:yMrSy90bdcddavTH8ZUjqb9FamNPyEkqno7WLzSAYDbDnKoCVrzoD+HK:UyAuGSIeRSqnocgbneVrz+

Malware Config

Extracted

Family

amadey

Version

3.87

Botnet

59b440

C2

http://77.91.68.18

Attributes
  • install_dir

    b40d11255d

  • install_file

    saves.exe

  • strings_key

    fa622dfc42544927a6471829ee1fa9fe

  • url_paths

    /nice/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

redline

Botnet

mrak

C2

77.91.124.82:19071

Attributes
  • auth_value

    7d9a335ab5dfd42d374867c96fe25302

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5bc4a6b3d5d850441455c1201b411fa16528c9d21a13517fd2f373d1536d57f6.exe
    "C:\Users\Admin\AppData\Local\Temp\5bc4a6b3d5d850441455c1201b411fa16528c9d21a13517fd2f373d1536d57f6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3777972.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3777972.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8348215.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8348215.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2680
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9983638.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9983638.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7386397.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7386397.exe
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Executes dropped EXE
            • Windows security modification
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4580
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2874109.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2874109.exe
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:888
            • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
              "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3084
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN saves.exe /TR "C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe" /F
                7⤵
                • Creates scheduled task(s)
                PID:4300
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "saves.exe" /P "Admin:N"&&CACLS "saves.exe" /P "Admin:R" /E&&echo Y|CACLS "..\b40d11255d" /P "Admin:N"&&CACLS "..\b40d11255d" /P "Admin:R" /E&&Exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1064
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                  8⤵
                    PID:3868
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "saves.exe" /P "Admin:N"
                    8⤵
                      PID:4420
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "saves.exe" /P "Admin:R" /E
                      8⤵
                        PID:4524
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                        8⤵
                          PID:4088
                        • C:\Windows\SysWOW64\cacls.exe
                          CACLS "..\b40d11255d" /P "Admin:N"
                          8⤵
                            PID:2184
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "..\b40d11255d" /P "Admin:R" /E
                            8⤵
                              PID:2320
                    • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6726173.exe
                      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6726173.exe
                      4⤵
                      • Executes dropped EXE
                      PID:2168
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3940 --field-trial-handle=2744,i,16362475727591565961,3676688664819797550,262144 --variations-seed-version /prefetch:8
                1⤵
                  PID:1988
                • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                  C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                  1⤵
                  • Executes dropped EXE
                  PID:1720
                • C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                  C:\Users\Admin\AppData\Local\Temp\b40d11255d\saves.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2688

                Network

                • flag-us
                  DNS
                  97.17.167.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  97.17.167.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  172.210.232.199.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  172.210.232.199.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  133.32.126.40.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  133.32.126.40.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  95.221.229.192.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  95.221.229.192.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  228.249.119.40.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  228.249.119.40.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  26.165.165.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  26.165.165.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  56.126.166.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  56.126.166.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  104.219.191.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  104.219.191.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  58.55.71.13.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  58.55.71.13.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  23.236.111.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  23.236.111.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  224.162.46.104.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  224.162.46.104.in-addr.arpa
                  IN PTR
                  Response
                • 172.217.169.74:443
                  46 B
                  40 B
                  1
                  1
                • 13.107.253.64:443
                  46 B
                  40 B
                  1
                  1
                • 77.91.68.18:80
                  saves.exe
                  260 B
                  5
                • 77.91.124.82:19071
                  i6726173.exe
                  260 B
                  5
                • 77.91.124.82:19071
                  i6726173.exe
                  260 B
                  5
                • 77.91.68.18:80
                  saves.exe
                  260 B
                  5
                • 77.91.124.82:19071
                  i6726173.exe
                  260 B
                  5
                • 77.91.68.18:80
                  saves.exe
                  260 B
                  5
                • 77.91.124.82:19071
                  i6726173.exe
                  260 B
                  5
                • 77.91.124.82:19071
                  i6726173.exe
                  104 B
                  2
                • 8.8.8.8:53
                  97.17.167.52.in-addr.arpa
                  dns
                  71 B
                  145 B
                  1
                  1

                  DNS Request

                  97.17.167.52.in-addr.arpa

                • 8.8.8.8:53
                  172.210.232.199.in-addr.arpa
                  dns
                  74 B
                  128 B
                  1
                  1

                  DNS Request

                  172.210.232.199.in-addr.arpa

                • 8.8.8.8:53
                  133.32.126.40.in-addr.arpa
                  dns
                  72 B
                  158 B
                  1
                  1

                  DNS Request

                  133.32.126.40.in-addr.arpa

                • 8.8.8.8:53
                  95.221.229.192.in-addr.arpa
                  dns
                  73 B
                  144 B
                  1
                  1

                  DNS Request

                  95.221.229.192.in-addr.arpa

                • 8.8.8.8:53
                  228.249.119.40.in-addr.arpa
                  dns
                  73 B
                  159 B
                  1
                  1

                  DNS Request

                  228.249.119.40.in-addr.arpa

                • 8.8.8.8:53
                  26.165.165.52.in-addr.arpa
                  dns
                  72 B
                  146 B
                  1
                  1

                  DNS Request

                  26.165.165.52.in-addr.arpa

                • 8.8.8.8:53
                  56.126.166.20.in-addr.arpa
                  dns
                  72 B
                  158 B
                  1
                  1

                  DNS Request

                  56.126.166.20.in-addr.arpa

                • 8.8.8.8:53
                  104.219.191.52.in-addr.arpa
                  dns
                  73 B
                  147 B
                  1
                  1

                  DNS Request

                  104.219.191.52.in-addr.arpa

                • 8.8.8.8:53
                  58.55.71.13.in-addr.arpa
                  dns
                  70 B
                  144 B
                  1
                  1

                  DNS Request

                  58.55.71.13.in-addr.arpa

                • 8.8.8.8:53
                  23.236.111.52.in-addr.arpa
                  dns
                  72 B
                  158 B
                  1
                  1

                  DNS Request

                  23.236.111.52.in-addr.arpa

                • 8.8.8.8:53
                  224.162.46.104.in-addr.arpa
                  dns
                  73 B
                  147 B
                  1
                  1

                  DNS Request

                  224.162.46.104.in-addr.arpa

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x3777972.exe

                  Filesize

                  706KB

                  MD5

                  f6ba7c50940a01f86afe729040126436

                  SHA1

                  b06432638ba5a56a63b3da694b56747baf2cec53

                  SHA256

                  a9d20d7785173a6c0e1d30e5993f9accedd769d84ffc1cbc8ac0e4e92565273f

                  SHA512

                  a970c29b61266f12456e34bc77b314ef4ef24af06ff9188dd6d159493bad295b23f25d332185e88a467c0e5c1f92e84883820d3a7ca31cea438a071f711e3e8f

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8348215.exe

                  Filesize

                  539KB

                  MD5

                  43b6c22328a0a02395cbd74401f44a8a

                  SHA1

                  3136b1d7c6701f41b5bb4c3cdb90524fffa71a6d

                  SHA256

                  9ce7659a95fa917861a111360d9f2db1504c3b91699d4519bab89d7dc0d3eeb9

                  SHA512

                  38bc63cb1cd6d1a97b9ed45a971676d0626bef7b65303241cc5b9c47c5dc787014055f91ff2e9fa2d0e1ca6ae4a42f668dec1ecdd3f0662421ed6cb2d28133cb

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i6726173.exe

                  Filesize

                  174KB

                  MD5

                  d9e172e8c93c969fef68d92855d61290

                  SHA1

                  dd65c266d42d21c14b49b1de0375a66b1a19ac26

                  SHA256

                  0139e1cd6bcb2256980f3cf0e304483833e3f9462efc3eae2f2ed0ecf83e4df7

                  SHA512

                  1a7bbddfc994f5961f0c6300c0fd6af9b0004b02830d69f586d7ab1396c8a902619c0151232e99270222639c5e98c601cdff65900242ffdb4546abb50a5c2710

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9983638.exe

                  Filesize

                  384KB

                  MD5

                  a7239e0ef7c9bc06705edea8ae600429

                  SHA1

                  41a1408e0bd92d61b21070156128e49cfd719486

                  SHA256

                  d5a09c150d554eef5497b8f05aa50bb5e00641afddbd3e9edee4dca7a898f9e8

                  SHA512

                  1cc25a9f284f5ba888a38b5930f8c9d6a73db7998523a058e24f4bc1e83004b2a8a100f43cb68c1623dbcc4efd50e5014907d4d1fa7e969c9052f0ccef18c97d

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g7386397.exe

                  Filesize

                  202KB

                  MD5

                  8165761fbea6f3de02fe2d7bfb24b52f

                  SHA1

                  1cf5642007a803b76759478977411b5e873bc89d

                  SHA256

                  03d4a1665de27fb377c69e5deec51f77e2224840e4d99ecf8053c6857753e74e

                  SHA512

                  ed2e024d35a66d758d9ad496b69ed7232034b9cb8fb1b0d3c737c02bb8881650e5f35fdb5e60c4c2e909fdaa0cad45326317737c9a3d090d0e2bcc3e608413b4

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2874109.exe

                  Filesize

                  337KB

                  MD5

                  6bac6530e3c54a32c6f0d435806d16e1

                  SHA1

                  8724238e4cdce3093e346264d3dcc6798bdfb71c

                  SHA256

                  493db63bcabb95557a1ebee2a2ab964abd51f8f6505a590b096498d364d839a8

                  SHA512

                  26cdcf213bbd376d17a6d95cd2b04f361c774cbfbffb54eb8ebaf2f0dc18e9b6d07e95fbc57716a64f2155ae26f75e6626fa1cf2700c12d2e408ffad2db9ef7c

                • memory/2168-79-0x000000000A010000-0x000000000A022000-memory.dmp

                  Filesize

                  72KB

                • memory/2168-78-0x000000000A0E0000-0x000000000A1EA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/2168-77-0x000000000A580000-0x000000000AB98000-memory.dmp

                  Filesize

                  6.1MB

                • memory/2168-76-0x0000000004910000-0x0000000004916000-memory.dmp

                  Filesize

                  24KB

                • memory/2168-75-0x0000000000130000-0x0000000000160000-memory.dmp

                  Filesize

                  192KB

                • memory/2168-80-0x000000000A070000-0x000000000A0AC000-memory.dmp

                  Filesize

                  240KB

                • memory/2168-81-0x000000000A1F0000-0x000000000A23C000-memory.dmp

                  Filesize

                  304KB

                • memory/4580-46-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-50-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-44-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-42-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-40-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-38-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-36-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-58-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-32-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-48-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-52-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-54-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-56-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-34-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-31-0x00000000021C0000-0x00000000021D6000-memory.dmp

                  Filesize

                  88KB

                • memory/4580-30-0x00000000021C0000-0x00000000021DC000-memory.dmp

                  Filesize

                  112KB

                • memory/4580-29-0x0000000004A00000-0x0000000004FA4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/4580-28-0x0000000000770000-0x000000000078E000-memory.dmp

                  Filesize

                  120KB

                We care about your privacy.

                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.