Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240426-en
  • resource tags

    arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    29/05/2024, 00:10

General

  • Target

    efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe

  • Size

    1.8MB

  • MD5

    cd6c579cfcb9bae246f8d572871b287e

  • SHA1

    9107eb0f184e0b474e875eb33aec5a7ee404fc28

  • SHA256

    efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6

  • SHA512

    10bfc8f6972bcba99a5e5c6000eeab625f150a19c9eea9d88cb9c9f6dc60a8e2097cd71e69d73690deec6a800452f1587c9739f7de314e77ebda4a252e321e91

  • SSDEEP

    49152:6jpTfaQ241PKkQL0a8r+63cfjvypiFhzwIW5rYXga:2TyQ2APkHYsfjqohcnrYXH

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

0e6740

C2

http://147.45.47.155

Attributes
  • install_dir

    9217037dc9

  • install_file

    explortu.exe

  • strings_key

    8e894a8a4a3d0da8924003a561cfb244

  • url_paths

    /ku4Nor9/index.php

rc4.plain

Extracted

Family

amadey

Version

4.21

Botnet

49e482

C2

http://147.45.47.70

Attributes
  • install_dir

    1b29d73536

  • install_file

    axplont.exe

  • strings_key

    4d31dd1a190d9879c21fac6d87dc0043

  • url_paths

    /tr8nomy/index.php

rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 10 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe
    "C:\Users\Admin\AppData\Local\Temp\efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
        "C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe"
        3⤵
          PID:1556
        • C:\Users\Admin\1000004002\7f936bf383.exe
          "C:\Users\Admin\1000004002\7f936bf383.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4756
          • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
            "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3076
        • C:\Users\Admin\AppData\Local\Temp\1000005001\9b0e2d08f1.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\9b0e2d08f1.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:2428
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1492
    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3488
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:4604
    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1984
    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:1340
    • C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
      1⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:3872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\1000004002\7f936bf383.exe

      Filesize

      1.8MB

      MD5

      b5f49ea48bd953e7fdf40e250be52086

      SHA1

      24e385f539225596258193b66a9a24929616612f

      SHA256

      62bd4a50cdbd1adda3a0d82a1f27bddc872ccf9c232be064033efd9feb531ed2

      SHA512

      93eed99f7581df3e082dc08a19124d5f09118d70aa3559ee7f1c74ea13f2cdeac85bfff453b5529962596f317113e7be75ee6bf7d56724c8c4adb4816cbad522

    • C:\Users\Admin\AppData\Local\Temp\1000005001\9b0e2d08f1.exe

      Filesize

      2.3MB

      MD5

      c1fa27ad9d47cc1c4b35ce3cb0bf1a35

      SHA1

      94bf0f0fb1393111f2a1c048c42665fb6ba595c9

      SHA256

      4762b2238b692ae0361a701516467ad8e46c0c9ac2a53518e16df165ab1ab5be

      SHA512

      12993b9d29767f47010ab46193ae1e94780b1d61178fbe287e3c0acff0a38990ccc92bed6f954ed295c8ed4d831db9ec9e259925149f8cb1eacdc77e82f5b17d

    • C:\Users\Admin\AppData\Local\Temp\9217037dc9\explortu.exe

      Filesize

      1.8MB

      MD5

      cd6c579cfcb9bae246f8d572871b287e

      SHA1

      9107eb0f184e0b474e875eb33aec5a7ee404fc28

      SHA256

      efba0ede597d3c49c0bb6c2506a117f0c8a8858792af77ea24a97df34f8e79a6

      SHA512

      10bfc8f6972bcba99a5e5c6000eeab625f150a19c9eea9d88cb9c9f6dc60a8e2097cd71e69d73690deec6a800452f1587c9739f7de314e77ebda4a252e321e91

    • memory/1340-135-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/1340-132-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/1492-86-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/1492-82-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/1984-110-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/1984-112-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/2404-16-0x0000000000030000-0x00000000004EE000-memory.dmp

      Filesize

      4.7MB

    • memory/2404-1-0x0000000077946000-0x0000000077948000-memory.dmp

      Filesize

      8KB

    • memory/2404-0-0x0000000000030000-0x00000000004EE000-memory.dmp

      Filesize

      4.7MB

    • memory/2404-5-0x0000000000030000-0x00000000004EE000-memory.dmp

      Filesize

      4.7MB

    • memory/2404-2-0x0000000000031000-0x000000000005F000-memory.dmp

      Filesize

      184KB

    • memory/2404-3-0x0000000000030000-0x00000000004EE000-memory.dmp

      Filesize

      4.7MB

    • memory/2428-113-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-104-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-116-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-60-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-122-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-76-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-92-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-119-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-101-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-98-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-125-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-128-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-84-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-137-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-95-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/2428-88-0x0000000000DB0000-0x00000000013A0000-memory.dmp

      Filesize

      5.9MB

    • memory/3036-97-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-75-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-91-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-17-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-19-0x0000000000A01000-0x0000000000A2F000-memory.dmp

      Filesize

      184KB

    • memory/3036-94-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-20-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-130-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-21-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-80-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-127-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-100-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-124-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-79-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-103-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-121-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-118-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-106-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-115-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-77-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3036-74-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-102-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-89-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-93-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-96-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-117-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-73-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-105-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-114-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-120-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-78-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-123-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-129-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-90-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-138-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-126-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3076-99-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3488-85-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3488-87-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3872-136-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/3872-134-0x00000000009C0000-0x0000000000E78000-memory.dmp

      Filesize

      4.7MB

    • memory/4604-108-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/4604-111-0x0000000000A00000-0x0000000000EBE000-memory.dmp

      Filesize

      4.7MB

    • memory/4756-70-0x0000000000910000-0x0000000000DC8000-memory.dmp

      Filesize

      4.7MB

    • memory/4756-39-0x0000000000910000-0x0000000000DC8000-memory.dmp

      Filesize

      4.7MB

    • memory/4756-40-0x0000000000910000-0x0000000000DC8000-memory.dmp

      Filesize

      4.7MB