Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 15:00

General

  • Target

    2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe

  • Size

    681KB

  • MD5

    00e1431f15d4e7d7521adaf56d1cf9eb

  • SHA1

    63c4a9d2327a46296e4d54c9baeb20f683ec9d87

  • SHA256

    2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609

  • SHA512

    c0e78ad73ffa3f4c0ab94ce0e21dd3cb0638cdbccbe5b3bcd0d841193a11fbd3485c176b010c3196b21d940dfa5b18f09f53e3dfdd28c5ba881df1637584118d

  • SSDEEP

    12288:Cp1zzClVwk1lf0PmOPRQBsoNiDgOIu9diWKg0p2/DqJg7:Cpx8VwkiWaUOIuXZ

Malware Config

Extracted

Family

asyncrat

Version

0.5.7B

Botnet

3333----Japanese----3333

Mutex

Aakn1515knAakn1515kn!

Attributes
  • delay

    3

  • install

    false

  • install_folder

    %AppData%

  • pastebin_config

    https://pastebin.com/raw/uqaaCRiU

aes.plain

Extracted

Family

redline

Botnet

JAPANPORN

C2

45.134.225.35:7821

Attributes
  • auth_value

    18d8418fe71c08942d2ddd0435edb9e5

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Redline family
  • System Binary Proxy Execution: Regsvcs/Regasm 1 TTPs 2 IoCs

    Abuse Regasm to proxy execution of malicious code.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe
    "C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe"
    1⤵
    • System Binary Proxy Execution: Regsvcs/Regasm
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Nomzctbtacmztkfxofvv.vbs"
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:808
      • C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe
        "C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4848
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\2dd40beb048efe94f7a62ac83f95a5da2815e05a248ef970dff3f20a4eb8f609.exe" -Force
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3360
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Nomzctbtacmztkfxofvv.vbs

    Filesize

    118B

    MD5

    c79baba091f7498ce4d61f075f88a4b7

    SHA1

    9906c4bf1e3365c38833c89cd9b1b50c3ccb64a3

    SHA256

    63d3754108ef87e215e9d68095b97d8c62468496fb7348cf0d4c76892bda2bad

    SHA512

    9f571c9211e5f1de1edf22c1ee5bfec5d90e7bc705c3963adbc8db20d56ee2a06b410318c2d61017dae49c4af20e4b53318561e265fa64406b50ef6f291bec18

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe

    Filesize

    63KB

    MD5

    0d5df43af2916f47d00c1573797c1a13

    SHA1

    230ab5559e806574d26b4c20847c368ed55483b0

    SHA256

    c066aee7aa3aa83f763ebc5541daa266ed6c648fbffcde0d836a13b221bb2adc

    SHA512

    f96cf9e1890746b12daf839a6d0f16f062b72c1b8a40439f96583f242980f10f867720232a6fa0f7d4d7ac0a7a6143981a5a130d6417ea98b181447134c7cfe2

  • C:\Users\Admin\AppData\Local\Temp\Yljfderdjwutqbwifekmjhjapanred.exe

    Filesize

    104KB

    MD5

    0eef332fd798b03319283bd2b10787a2

    SHA1

    14e4177525f12e20b00c21a05ba711057fb233da

    SHA256

    a54a8b8a85445de206467249b33785a9c1d33828b1eb57e3531d01ad7488e1b3

    SHA512

    fd205aaa4f94df3ec9d3699deb3384f9f51a28ef098cb0e89945ee5b188df6ba7c05b13ecda9c80cd8fddffb664a60f3bd41e566d4d48e2445469e9120c94994

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3j0pr0wj.eo0.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/2720-1678-0x00000000753E0000-0x0000000075B90000-memory.dmp

    Filesize

    7.7MB

  • memory/2720-1647-0x00000000753E0000-0x0000000075B90000-memory.dmp

    Filesize

    7.7MB

  • memory/2720-1646-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/3360-1673-0x0000000006450000-0x000000000646A000-memory.dmp

    Filesize

    104KB

  • memory/3360-1670-0x00000000059C0000-0x0000000005D14000-memory.dmp

    Filesize

    3.3MB

  • memory/3360-1660-0x0000000005100000-0x0000000005166000-memory.dmp

    Filesize

    408KB

  • memory/3360-1671-0x0000000005F20000-0x0000000005F3E000-memory.dmp

    Filesize

    120KB

  • memory/3360-1672-0x00000000075A0000-0x0000000007C1A000-memory.dmp

    Filesize

    6.5MB

  • memory/3360-1657-0x0000000004E90000-0x0000000004EB2000-memory.dmp

    Filesize

    136KB

  • memory/3360-1651-0x0000000002630000-0x0000000002666000-memory.dmp

    Filesize

    216KB

  • memory/3360-1654-0x00000000051B0000-0x00000000057D8000-memory.dmp

    Filesize

    6.2MB

  • memory/3360-1674-0x00000000071C0000-0x0000000007256000-memory.dmp

    Filesize

    600KB

  • memory/3360-1675-0x0000000006510000-0x0000000006532000-memory.dmp

    Filesize

    136KB

  • memory/4848-1659-0x0000000004FC0000-0x000000000500C000-memory.dmp

    Filesize

    304KB

  • memory/4848-1652-0x00000000006A0000-0x00000000006C0000-memory.dmp

    Filesize

    128KB

  • memory/4848-1653-0x00000000054B0000-0x0000000005AC8000-memory.dmp

    Filesize

    6.1MB

  • memory/4848-1655-0x0000000004F20000-0x0000000004F32000-memory.dmp

    Filesize

    72KB

  • memory/4848-1656-0x0000000005050000-0x000000000515A000-memory.dmp

    Filesize

    1.0MB

  • memory/4848-1658-0x0000000004F80000-0x0000000004FBC000-memory.dmp

    Filesize

    240KB

  • memory/4912-34-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-1648-0x00000000753E0000-0x0000000075B90000-memory.dmp

    Filesize

    7.7MB

  • memory/4912-12-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-10-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-8-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-6-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-4-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-60-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-46-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-38-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-27-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-22-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-3-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-1630-0x00000000753E0000-0x0000000075B90000-memory.dmp

    Filesize

    7.7MB

  • memory/4912-1629-0x0000000004F80000-0x0000000004FE6000-memory.dmp

    Filesize

    408KB

  • memory/4912-1631-0x0000000005090000-0x0000000005122000-memory.dmp

    Filesize

    584KB

  • memory/4912-1632-0x0000000005AD0000-0x0000000006074000-memory.dmp

    Filesize

    5.6MB

  • memory/4912-16-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-1640-0x0000000005270000-0x0000000005288000-memory.dmp

    Filesize

    96KB

  • memory/4912-18-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-20-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-14-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-25-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-28-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-31-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-32-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-0-0x00000000753EE000-0x00000000753EF000-memory.dmp

    Filesize

    4KB

  • memory/4912-36-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-40-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-42-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-44-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-48-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-50-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-52-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-54-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-56-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-58-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-62-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-66-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-64-0x0000000004DB0000-0x0000000004E2E000-memory.dmp

    Filesize

    504KB

  • memory/4912-2-0x0000000004DB0000-0x0000000004E34000-memory.dmp

    Filesize

    528KB

  • memory/4912-1-0x0000000000230000-0x00000000002E0000-memory.dmp

    Filesize

    704KB