Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
30bd57c625c...1b.exe
windows10-2004-x64
100e85c02906...31.exe
windows10-2004-x64
101ad22f7c20...da.exe
windows10-2004-x64
102f0934382a...84.exe
windows7-x64
102f0934382a...84.exe
windows10-2004-x64
10421c712a06...0d.exe
windows10-2004-x64
104958361c2a...c0.exe
windows10-2004-x64
104ee34ec273...69.exe
windows10-2004-x64
1054ae781e47...0d.exe
windows10-2004-x64
10597fd86cf2...51.exe
windows10-2004-x64
105af8e5b632...c7.exe
windows10-2004-x64
105edd2b7f66...17.exe
windows10-2004-x64
105eee268a87...c9.exe
windows10-2004-x64
1065a4c04d9e...25.exe
windows10-2004-x64
106d2e6d5049...21.exe
windows10-2004-x64
1077dcf40927...b4.exe
windows10-2004-x64
108c279e4e62...12.exe
windows10-2004-x64
108ee3fa55ce...d5.exe
windows10-2004-x64
108efb2f072c...7a.exe
windows10-2004-x64
10a717651d7f...a0.exe
windows10-2004-x64
10cecc5213e2...a1.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 19:03
Static task
static1
Behavioral task
behavioral1
Sample
0bd57c625c8696f13dca81e807695648802ac535fabc2f383ee13c655c34c21b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
0e85c029067c6b16235fdcf9b3b93f0b3aef80462a8991420b61166786a76d31.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
1ad22f7c20ecd9c3f25fef51c4432f8d6609d2a5f951e6a29ab4a3a9b7d2ebda.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
2f0934382aee1d9b657ffa98a2699fe864ed0a5bf8e1fc03bdcd479244e27b84.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
4958361c2a42ff04e4d71bc10a59d5ce9b6fae6d86deb588a01b229caeadf1c0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
4ee34ec273a7f43b89678eff087bf31e1b510415dcbb3ef6c8fcf0c06f036669.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
54ae781e479d4e60bdd8734270b33ab0db93c1543e6f477a3dcc2c93b42f7e0d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
597fd86cf22402c976ac13f554867cf010ab3d5c9bdcf8d817c66e620dce4751.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
5af8e5b632a39ba2220e0edd14997e390e73614f2bbcd55986f62325da0e16c7.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
5eee268a879c07625d7394a82b7c1c9212c1bd08e2f22fd5b294cc02b2f31cc9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
65a4c04d9eef0d0db884e244647345959a2f576dab0d856bc052140c13b17025.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
6d2e6d5049e4da686813824edc4aa0a843fff13079a0a9399739fe64efcfd021.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
77dcf409276e0e91ce08daea19f8477d18c5dba52a0ecbb55c40bc98744973b4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
8c279e4e627a1cf50482f625b1ee518eae0ac11a42f443c27e6f6ee04c180212.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
8ee3fa55ceed18988822ea9dd7e193a1c7e306b0010f172aee42ec3ddd3b2cd5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
8efb2f072c814649d82dcf129f78158d28b7ec827dd8deeccf8e21e23771ae7a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
a717651d7fa6766bf2853b11671e7a5465fd6b8d88661bb92df08a819e765da0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
cecc5213e25a8a2dfe40b0f517d513ce319f2cdf28bcc26df3130a53a46d79a1.exe
Resource
win10v2004-20240508-en
General
-
Target
5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe
-
Size
382KB
-
MD5
4d8700ac9e259e9c05ccb05abcd3e55b
-
SHA1
3ca1f31e449c427a5223165abee3858b8d3a1bc6
-
SHA256
5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917
-
SHA512
a52da5997013a09ab0fbcc5516eba9eee0bc6fb971294d8ca48b985a1d2030c495493d02eb7d7646b67787816ba65ad67331aa08411944dede4301d1b01e28cb
-
SSDEEP
6144:KUy+bnr+Xp0yN90QEvNhYCAaMbdsJNuYI50Y/BJf9+aOwYSlup:MMrny90xNhCbdsLxI+Yd+9w6p
Malware Config
Extracted
redline
kukish
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral12/memory/1524-7-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family behavioral12/memory/1524-9-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family behavioral12/memory/1524-11-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family behavioral12/memory/1524-8-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral12/files/0x0007000000023427-13.dat family_redline behavioral12/memory/5060-16-0x0000000000CA0000-0x0000000000CDE000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
pid Process 2500 1ma43UZ9.exe 5060 2qB706de.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2500 set thread context of 1524 2500 1ma43UZ9.exe 86 -
Program crash 2 IoCs
pid pid_target Process procid_target 3700 2500 WerFault.exe 83 1780 1524 WerFault.exe 86 -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4492 wrote to memory of 2500 4492 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe 83 PID 4492 wrote to memory of 2500 4492 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe 83 PID 4492 wrote to memory of 2500 4492 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe 83 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 2500 wrote to memory of 1524 2500 1ma43UZ9.exe 86 PID 4492 wrote to memory of 5060 4492 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe 93 PID 4492 wrote to memory of 5060 4492 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe 93 PID 4492 wrote to memory of 5060 4492 5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe"C:\Users\Admin\AppData\Local\Temp\5edd2b7f663bf0a7b691bb6245a12b15994b2b4ad9c92c369111de2c68731917.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1ma43UZ9.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1ma43UZ9.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:1524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 5404⤵
- Program crash
PID:1780
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2500 -s 5843⤵
- Program crash
PID:3700
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2qB706de.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2qB706de.exe2⤵
- Executes dropped EXE
PID:5060
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1524 -ip 15241⤵PID:4216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2500 -ip 25001⤵PID:3608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
295KB
MD5314f30b53027f3d7812a7ecc57c2be0d
SHA135b82de4d7a1bc2cee9d10b7de26616bad1271bd
SHA256460cacca4c0d9d81113eeaeaac4b343acd2e4347dd129183cbd2f58eddfbb9f7
SHA512fe4007c43e1896d3657486f170334ae5a20fd97ca282e2bdeb8783c96c3bbaad046fd81681355652a61bc79f33514f2be5b87d4ab7c404c2a65ad21b1434a480
-
Filesize
222KB
MD59b74f1c10b3f8287121fae55eb49628a
SHA118704ab838447c92b72d8232f8b58c365bde7a81
SHA2561ef108d65269eb110a6f0ef126353b41ca9f086b909bec23dabefb15024eb1fd
SHA5125bcb8cc16d6da308bd0f386a2cfdb2bec091963c4bb97c08487741774d1eebd03836fee6bfb1068fa9369d19f3e41164e3dc073ecaf61eec6bca3abf47a39a52