Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2023, 21:47

General

  • Target

    fb8a184cade7544ea1ec897b679edff542000cf31934900525f12e02f85eb9cb.exe

  • Size

    1.2MB

  • MD5

    9e0a65a6354df7e961d797ff850db432

  • SHA1

    6760ff14c6890d975c5ffb5a2cb8b6f3300ed115

  • SHA256

    fb8a184cade7544ea1ec897b679edff542000cf31934900525f12e02f85eb9cb

  • SHA512

    b90ae16f118333db8081b8921138425a6dfd29785c1b9ae884f590a12281d99a255b0ec3abb275ae9ec27468a07ab7393762b4edd6e32f5dcb9e608bf1f4eafb

  • SSDEEP

    24576:fyMGHOJwixm0Y3ELv66HZJxHzSd6T05Efj4Rx891fFOn2bt6Anu:qjHuZY3EWEZfSd00u4qNOnYtNn

Malware Config

Extracted

Family

redline

Botnet

gigant

C2

77.91.124.55:19071

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb8a184cade7544ea1ec897b679edff542000cf31934900525f12e02f85eb9cb.exe
    "C:\Users\Admin\AppData\Local\Temp\fb8a184cade7544ea1ec897b679edff542000cf31934900525f12e02f85eb9cb.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3348
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gl2cZ1op.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gl2cZ1op.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jd3tw7ja.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jd3tw7ja.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2628
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\WM7te5go.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\WM7te5go.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:3512
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LK3En3pn.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LK3En3pn.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1408
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Jm90GG6.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Jm90GG6.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2140
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                  PID:3268
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  7⤵
                    PID:3612
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 540
                      8⤵
                      • Program crash
                      PID:476
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 600
                    7⤵
                    • Program crash
                    PID:3432
                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mr852Yb.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mr852Yb.exe
                  6⤵
                  • Executes dropped EXE
                  PID:3508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 3612 -ip 3612
        1⤵
          PID:1732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2140 -ip 2140
          1⤵
            PID:2452

          Network

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gl2cZ1op.exe

                  Filesize

                  1.0MB

                  MD5

                  207e39b69d7fcde973111a1f3584b5cc

                  SHA1

                  f65911bdbc34f2310aadc194def9528bb64f75d0

                  SHA256

                  54b1927c8b0cd0b9a35cb91a8b444127c67d5767343e0cadbc071d60b2a873c2

                  SHA512

                  21528a60fa39450a9207764d41cc75c34806a8ef66971a64af6b575e5f4589d574711deaa0960128a9a51183d4a6142057f721aadc5a82f002c021b21595bc1d

                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Gl2cZ1op.exe

                  Filesize

                  1.0MB

                  MD5

                  207e39b69d7fcde973111a1f3584b5cc

                  SHA1

                  f65911bdbc34f2310aadc194def9528bb64f75d0

                  SHA256

                  54b1927c8b0cd0b9a35cb91a8b444127c67d5767343e0cadbc071d60b2a873c2

                  SHA512

                  21528a60fa39450a9207764d41cc75c34806a8ef66971a64af6b575e5f4589d574711deaa0960128a9a51183d4a6142057f721aadc5a82f002c021b21595bc1d

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jd3tw7ja.exe

                  Filesize

                  884KB

                  MD5

                  0a5863d64e23c4f3ef3200779c1ebff4

                  SHA1

                  e9bf567f5570e75e76b85b055cb1345a74f27ce8

                  SHA256

                  cd9360589c2015aee54ccf40f997c832bf2930ab69211f5d8a4698a5886e3d63

                  SHA512

                  ad4a65779b8a1991589f078b8b5016be7535b00762217612fcc5ae82864d8852f400d393b275841b336d09b29aaae501959651c4efabeba50ea1d454adb115d1

                • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Jd3tw7ja.exe

                  Filesize

                  884KB

                  MD5

                  0a5863d64e23c4f3ef3200779c1ebff4

                  SHA1

                  e9bf567f5570e75e76b85b055cb1345a74f27ce8

                  SHA256

                  cd9360589c2015aee54ccf40f997c832bf2930ab69211f5d8a4698a5886e3d63

                  SHA512

                  ad4a65779b8a1991589f078b8b5016be7535b00762217612fcc5ae82864d8852f400d393b275841b336d09b29aaae501959651c4efabeba50ea1d454adb115d1

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\WM7te5go.exe

                  Filesize

                  590KB

                  MD5

                  943b112749ec2b1d79d6d9dfbfbc61f6

                  SHA1

                  54345a752550c0fb4b7a9f7d604d6ca6e21ec8fb

                  SHA256

                  9e866e22f3b5578b8badbfdcbcb9ee9d3052a5bf1c87c22569e90ba464f3c3fa

                  SHA512

                  c8f30d5d0da0ff2b8abf6777fc541038e9fb9923e0b365aa0c21ab84c21593c7ba49edc640af0a3c1ae70160911be3d7a9dee4e9df0a57d97b2e41b0c4b08a7a

                • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\WM7te5go.exe

                  Filesize

                  590KB

                  MD5

                  943b112749ec2b1d79d6d9dfbfbc61f6

                  SHA1

                  54345a752550c0fb4b7a9f7d604d6ca6e21ec8fb

                  SHA256

                  9e866e22f3b5578b8badbfdcbcb9ee9d3052a5bf1c87c22569e90ba464f3c3fa

                  SHA512

                  c8f30d5d0da0ff2b8abf6777fc541038e9fb9923e0b365aa0c21ab84c21593c7ba49edc640af0a3c1ae70160911be3d7a9dee4e9df0a57d97b2e41b0c4b08a7a

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LK3En3pn.exe

                  Filesize

                  417KB

                  MD5

                  f222096f65e28b52fc018ad530a51db3

                  SHA1

                  0c10946b0657300cf01c7103e0f9bc3313d727e4

                  SHA256

                  ba63b2fb09ce0756ebbb4f972c35c0cea4079ab86292ac3651960fe46c0173f1

                  SHA512

                  047b915ec2ad4fbb6e41a51bd0b9c8672d72d74c3e97851b87150a27891671225303bb0efb660db91653f4256bedf1fbd847fda6cde94391b8e42119750dfb94

                • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LK3En3pn.exe

                  Filesize

                  417KB

                  MD5

                  f222096f65e28b52fc018ad530a51db3

                  SHA1

                  0c10946b0657300cf01c7103e0f9bc3313d727e4

                  SHA256

                  ba63b2fb09ce0756ebbb4f972c35c0cea4079ab86292ac3651960fe46c0173f1

                  SHA512

                  047b915ec2ad4fbb6e41a51bd0b9c8672d72d74c3e97851b87150a27891671225303bb0efb660db91653f4256bedf1fbd847fda6cde94391b8e42119750dfb94

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Jm90GG6.exe

                  Filesize

                  378KB

                  MD5

                  057684fdcfa64b387fd4c84e88123632

                  SHA1

                  2ec62abf9fe6673ef75748a0d89e201907608297

                  SHA256

                  91cd87b4da0609ef7b600b7d349deffdae7fcd863ddaf4bb5da0c5dfae1fc986

                  SHA512

                  bfccf7d1ee9f070c4b12ecb1062e4ba48b40a738d30b6bf0ee0bfb183021903ee775568ba3015d8be1af0686c16e2ebf610410c2061ec105a2bdf3221f0404b1

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Jm90GG6.exe

                  Filesize

                  378KB

                  MD5

                  057684fdcfa64b387fd4c84e88123632

                  SHA1

                  2ec62abf9fe6673ef75748a0d89e201907608297

                  SHA256

                  91cd87b4da0609ef7b600b7d349deffdae7fcd863ddaf4bb5da0c5dfae1fc986

                  SHA512

                  bfccf7d1ee9f070c4b12ecb1062e4ba48b40a738d30b6bf0ee0bfb183021903ee775568ba3015d8be1af0686c16e2ebf610410c2061ec105a2bdf3221f0404b1

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mr852Yb.exe

                  Filesize

                  231KB

                  MD5

                  0e26b34a4953bad439184ed9df9144aa

                  SHA1

                  470b2e126601928eaf3a1f9aafe4f59884ea07ab

                  SHA256

                  9bb4c8ad8de9222070fbd129e7d7b24224d5fe58522f16a896e4614eddb940c8

                  SHA512

                  3d0d3799fff587cb703ea40b121d7d5f3713d521cacb7c42d818349d12d2e9f6f44ffe33e25d8a232acd9a18234d8ea8cbb8eb20174c11c53f4122798e9ad3b0

                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mr852Yb.exe

                  Filesize

                  231KB

                  MD5

                  0e26b34a4953bad439184ed9df9144aa

                  SHA1

                  470b2e126601928eaf3a1f9aafe4f59884ea07ab

                  SHA256

                  9bb4c8ad8de9222070fbd129e7d7b24224d5fe58522f16a896e4614eddb940c8

                  SHA512

                  3d0d3799fff587cb703ea40b121d7d5f3713d521cacb7c42d818349d12d2e9f6f44ffe33e25d8a232acd9a18234d8ea8cbb8eb20174c11c53f4122798e9ad3b0

                • memory/3508-46-0x0000000007740000-0x00000000077D2000-memory.dmp

                  Filesize

                  584KB

                • memory/3508-48-0x00000000078F0000-0x00000000078FA000-memory.dmp

                  Filesize

                  40KB

                • memory/3508-55-0x0000000007900000-0x0000000007910000-memory.dmp

                  Filesize

                  64KB

                • memory/3508-54-0x0000000074010000-0x00000000747C0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3508-43-0x0000000074010000-0x00000000747C0000-memory.dmp

                  Filesize

                  7.7MB

                • memory/3508-44-0x0000000000830000-0x000000000086E000-memory.dmp

                  Filesize

                  248KB

                • memory/3508-45-0x0000000007C50000-0x00000000081F4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/3508-53-0x0000000007BB0000-0x0000000007BFC000-memory.dmp

                  Filesize

                  304KB

                • memory/3508-52-0x0000000007A30000-0x0000000007A6C000-memory.dmp

                  Filesize

                  240KB

                • memory/3508-49-0x0000000008820000-0x0000000008E38000-memory.dmp

                  Filesize

                  6.1MB

                • memory/3508-47-0x0000000007900000-0x0000000007910000-memory.dmp

                  Filesize

                  64KB

                • memory/3508-50-0x0000000007AA0000-0x0000000007BAA000-memory.dmp

                  Filesize

                  1.0MB

                • memory/3508-51-0x00000000079D0000-0x00000000079E2000-memory.dmp

                  Filesize

                  72KB

                • memory/3612-39-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/3612-36-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/3612-37-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB

                • memory/3612-35-0x0000000000400000-0x0000000000428000-memory.dmp

                  Filesize

                  160KB