Analysis Overview
SHA256
301dab91222f7ec5df8ac2e0b92a8a671697e53c29e55f14ad84643cc48bbed2
Threat Level: Known bad
The file 301dab91222f7ec5df8ac2e0b92a8a671697e53c29e55f14ad84643cc48bbed2 was found to be: Known bad.
Malicious Activity Summary
Mystic
RedLine
Detect Mystic stealer payload
RedLine payload
Executes dropped EXE
Adds Run key to start application
Suspicious use of SetThreadContext
Unsigned PE
Program crash
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-07 06:31
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-07 06:31
Reported
2023-10-07 06:34
Platform
win10v2004-20230915-en
Max time kernel
142s
Max time network
150s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Mystic
RedLine
RedLine payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wO8Aq2lq.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\na6tL7Pn.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GZ3NJ9gf.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj9SX3Gs.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Hf972PA.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wO8Aq2lq.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\na6tL7Pn.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GZ3NJ9gf.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj9SX3Gs.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\301dab91222f7ec5df8ac2e0b92a8a671697e53c29e55f14ad84643cc48bbed2.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2420 set thread context of 3176 | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\301dab91222f7ec5df8ac2e0b92a8a671697e53c29e55f14ad84643cc48bbed2.exe
"C:\Users\Admin\AppData\Local\Temp\301dab91222f7ec5df8ac2e0b92a8a671697e53c29e55f14ad84643cc48bbed2.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wO8Aq2lq.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wO8Aq2lq.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\na6tL7Pn.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\na6tL7Pn.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GZ3NJ9gf.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GZ3NJ9gf.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj9SX3Gs.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj9SX3Gs.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2420 -ip 2420
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3176 -ip 3176
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 540
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 608
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Hf972PA.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Hf972PA.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 59.128.231.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 69.31.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 171.39.242.20.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| FI | 77.91.124.55:19071 | tcp | |
| GB | 96.16.110.41:443 | tcp | |
| US | 192.229.221.95:80 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
| FI | 77.91.124.55:19071 | tcp | |
| FI | 77.91.124.55:19071 | tcp | |
| US | 8.8.8.8:53 | 3.173.189.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wO8Aq2lq.exe
| MD5 | f3e5abe7edeba1eed973bd079976ac1b |
| SHA1 | 7f7637334c5da8dd6c1f608cd395d46df7c39642 |
| SHA256 | 5a15203c1e5951cf9d4a97749c31308ba0ddb3c122f22ff089b3cfadc571892f |
| SHA512 | 62bbf66f3c2f469a45344b4d9cc99bee8f7bf617a26e3824fabd90110df468edcffad3314f2bec05c90521bda54e170c0886b2ec90c9bfd7ed7ab163524db77a |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wO8Aq2lq.exe
| MD5 | f3e5abe7edeba1eed973bd079976ac1b |
| SHA1 | 7f7637334c5da8dd6c1f608cd395d46df7c39642 |
| SHA256 | 5a15203c1e5951cf9d4a97749c31308ba0ddb3c122f22ff089b3cfadc571892f |
| SHA512 | 62bbf66f3c2f469a45344b4d9cc99bee8f7bf617a26e3824fabd90110df468edcffad3314f2bec05c90521bda54e170c0886b2ec90c9bfd7ed7ab163524db77a |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\na6tL7Pn.exe
| MD5 | 83ab5b39ec2fcd55d695697e373cb55c |
| SHA1 | 593b5b65f6da80b620b6fc14c2e6f0f893172baf |
| SHA256 | bbde4eb06fba00c9cfd38f849ecf86ae550c6f1dd4f0824798952e52636ec6bb |
| SHA512 | d969bb28699958848f3e8555dafc2f47eb3428fc5c8a1d92709e202304cf23f051a4f0c55d3d4f6cb7867b31d42049e21f1a6a7bccc86558855965cc06bc4956 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\na6tL7Pn.exe
| MD5 | 83ab5b39ec2fcd55d695697e373cb55c |
| SHA1 | 593b5b65f6da80b620b6fc14c2e6f0f893172baf |
| SHA256 | bbde4eb06fba00c9cfd38f849ecf86ae550c6f1dd4f0824798952e52636ec6bb |
| SHA512 | d969bb28699958848f3e8555dafc2f47eb3428fc5c8a1d92709e202304cf23f051a4f0c55d3d4f6cb7867b31d42049e21f1a6a7bccc86558855965cc06bc4956 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GZ3NJ9gf.exe
| MD5 | dd8c0898d75aa76eceb7f1a33be85708 |
| SHA1 | 0c78577787cf4f0c83d005afaf70cbd65fbfc3c6 |
| SHA256 | 0b8b7638a7bdb7de88011143da1f276110c5f108bcf8a4f0b8da81234f7a5fae |
| SHA512 | 9b3a3744d4678fa397977ba52e5400a790a7ef1f22906da8d93872edeaad0019b89905b0bb80de2898961e40efa323c700c863b0751e72b4e75cf43882554dc4 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GZ3NJ9gf.exe
| MD5 | dd8c0898d75aa76eceb7f1a33be85708 |
| SHA1 | 0c78577787cf4f0c83d005afaf70cbd65fbfc3c6 |
| SHA256 | 0b8b7638a7bdb7de88011143da1f276110c5f108bcf8a4f0b8da81234f7a5fae |
| SHA512 | 9b3a3744d4678fa397977ba52e5400a790a7ef1f22906da8d93872edeaad0019b89905b0bb80de2898961e40efa323c700c863b0751e72b4e75cf43882554dc4 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj9SX3Gs.exe
| MD5 | e7dba880314e9f98816aa24b7319f532 |
| SHA1 | 614373b62f25636d1f4f89ad4960300b9bed7b26 |
| SHA256 | ec53a9d3d894367786306e87248b550ecaae629cc97e8a2540861f9553a85a0c |
| SHA512 | 5368f75943eea01a3056a8e7d2f46c4c795ebc29bb7b9d3cf4ce182f5b0e2b69d9be1b373da24efbea4a829cf4d9afe01c5dc85ffc5ae68f84a50e6b0dd568bd |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Zj9SX3Gs.exe
| MD5 | e7dba880314e9f98816aa24b7319f532 |
| SHA1 | 614373b62f25636d1f4f89ad4960300b9bed7b26 |
| SHA256 | ec53a9d3d894367786306e87248b550ecaae629cc97e8a2540861f9553a85a0c |
| SHA512 | 5368f75943eea01a3056a8e7d2f46c4c795ebc29bb7b9d3cf4ce182f5b0e2b69d9be1b373da24efbea4a829cf4d9afe01c5dc85ffc5ae68f84a50e6b0dd568bd |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe
| MD5 | f0831f173733de08511f3a0739f278a6 |
| SHA1 | 06dc809d653c5d2c97386084ae13b50a73eb5b60 |
| SHA256 | 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27 |
| SHA512 | 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1HH11RY2.exe
| MD5 | f0831f173733de08511f3a0739f278a6 |
| SHA1 | 06dc809d653c5d2c97386084ae13b50a73eb5b60 |
| SHA256 | 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27 |
| SHA512 | 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3 |
memory/3176-35-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3176-36-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3176-37-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3176-39-0x0000000000400000-0x0000000000428000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Hf972PA.exe
| MD5 | 92ef0d09e9f6c105cf16d9e22d4c98fe |
| SHA1 | 3fc8699c738c94b66ccf8269ec3c1b67613e2b64 |
| SHA256 | ba34a9737f2006969b525bb929aa1b8b714c9d344332c31b9c76d480be791e21 |
| SHA512 | 139c7321f27b03dfbbe1ecd09275bca0b7a7c6c28bbb6a5b0b2859cd598578623129ae92e79a3246db16cb8c53eaf4c05d1a5ca7e7ab4575053718c946e3d645 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Hf972PA.exe
| MD5 | 92ef0d09e9f6c105cf16d9e22d4c98fe |
| SHA1 | 3fc8699c738c94b66ccf8269ec3c1b67613e2b64 |
| SHA256 | ba34a9737f2006969b525bb929aa1b8b714c9d344332c31b9c76d480be791e21 |
| SHA512 | 139c7321f27b03dfbbe1ecd09275bca0b7a7c6c28bbb6a5b0b2859cd598578623129ae92e79a3246db16cb8c53eaf4c05d1a5ca7e7ab4575053718c946e3d645 |
memory/4292-44-0x00000000741F0000-0x00000000749A0000-memory.dmp
memory/4292-43-0x0000000000430000-0x000000000046E000-memory.dmp
memory/4292-45-0x00000000076C0000-0x0000000007C64000-memory.dmp
memory/4292-46-0x00000000071F0000-0x0000000007282000-memory.dmp
memory/4292-47-0x0000000007460000-0x0000000007470000-memory.dmp
memory/4292-48-0x00000000073A0000-0x00000000073AA000-memory.dmp
memory/4292-49-0x0000000008290000-0x00000000088A8000-memory.dmp
memory/4292-50-0x0000000007580000-0x000000000768A000-memory.dmp
memory/4292-51-0x0000000007490000-0x00000000074A2000-memory.dmp
memory/4292-52-0x00000000074F0000-0x000000000752C000-memory.dmp
memory/4292-53-0x0000000007530000-0x000000000757C000-memory.dmp
memory/4292-54-0x00000000741F0000-0x00000000749A0000-memory.dmp
memory/4292-55-0x0000000007460000-0x0000000007470000-memory.dmp