Analysis
-
max time kernel
140s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2023 10:59
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe
-
Size
1.2MB
-
MD5
b81cd3142a789eca2228e02e2a31229c
-
SHA1
6673628188e3aaa5cc5e3a0fd20cd472a85f237f
-
SHA256
1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b
-
SHA512
1b8855f6be99ade9f5d34a9bc69ba574a77957f397cd5015958eea3508e485934c1092aefebdf012b5671570c7fff8b0056b3325b56d0392abc55581599bb19c
-
SSDEEP
24576:tyg79ARUhCAlCegO5Q+wvF36AFIVjtftkIKVHXKT+w:Ik9ARmwOqjF36N/Nri
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2840-35-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2840-36-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2840-37-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/2840-39-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2mE712ld.exe family_redline C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2mE712ld.exe family_redline behavioral2/memory/3440-43-0x00000000003E0000-0x000000000041E000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
TQ8Ny3fX.exeyI0rw7Oy.exeou1po6co.exeSV7Lf3oJ.exe1KW20JF5.exe2mE712ld.exepid process 3692 TQ8Ny3fX.exe 468 yI0rw7Oy.exe 1568 ou1po6co.exe 772 SV7Lf3oJ.exe 100 1KW20JF5.exe 3440 2mE712ld.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exeTQ8Ny3fX.exeyI0rw7Oy.exeou1po6co.exeSV7Lf3oJ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" TQ8Ny3fX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" yI0rw7Oy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" ou1po6co.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" SV7Lf3oJ.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1KW20JF5.exedescription pid process target process PID 100 set thread context of 2840 100 1KW20JF5.exe AppLaunch.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2996 100 WerFault.exe 1KW20JF5.exe 4868 2840 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exeTQ8Ny3fX.exeyI0rw7Oy.exeou1po6co.exeSV7Lf3oJ.exe1KW20JF5.exedescription pid process target process PID 4936 wrote to memory of 3692 4936 NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe TQ8Ny3fX.exe PID 4936 wrote to memory of 3692 4936 NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe TQ8Ny3fX.exe PID 4936 wrote to memory of 3692 4936 NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe TQ8Ny3fX.exe PID 3692 wrote to memory of 468 3692 TQ8Ny3fX.exe yI0rw7Oy.exe PID 3692 wrote to memory of 468 3692 TQ8Ny3fX.exe yI0rw7Oy.exe PID 3692 wrote to memory of 468 3692 TQ8Ny3fX.exe yI0rw7Oy.exe PID 468 wrote to memory of 1568 468 yI0rw7Oy.exe ou1po6co.exe PID 468 wrote to memory of 1568 468 yI0rw7Oy.exe ou1po6co.exe PID 468 wrote to memory of 1568 468 yI0rw7Oy.exe ou1po6co.exe PID 1568 wrote to memory of 772 1568 ou1po6co.exe SV7Lf3oJ.exe PID 1568 wrote to memory of 772 1568 ou1po6co.exe SV7Lf3oJ.exe PID 1568 wrote to memory of 772 1568 ou1po6co.exe SV7Lf3oJ.exe PID 772 wrote to memory of 100 772 SV7Lf3oJ.exe 1KW20JF5.exe PID 772 wrote to memory of 100 772 SV7Lf3oJ.exe 1KW20JF5.exe PID 772 wrote to memory of 100 772 SV7Lf3oJ.exe 1KW20JF5.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 100 wrote to memory of 2840 100 1KW20JF5.exe AppLaunch.exe PID 772 wrote to memory of 3440 772 SV7Lf3oJ.exe 2mE712ld.exe PID 772 wrote to memory of 3440 772 SV7Lf3oJ.exe 2mE712ld.exe PID 772 wrote to memory of 3440 772 SV7Lf3oJ.exe 2mE712ld.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1f3e03ca7bfcee157393fb94a3450e5a79979b8f5c0b85427ab51908bb78810b_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TQ8Ny3fX.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TQ8Ny3fX.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yI0rw7Oy.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yI0rw7Oy.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ou1po6co.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ou1po6co.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\SV7Lf3oJ.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\SV7Lf3oJ.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KW20JF5.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KW20JF5.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 5488⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1367⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2mE712ld.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2mE712ld.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 100 -ip 1001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2840 -ip 28401⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TQ8Ny3fX.exeFilesize
1.0MB
MD58ca2811ee4fae71a570298ebc6efcbac
SHA1475da0caa3e4b5931344c9a739c46513edbe0830
SHA256803bdeb4bc4493002015ca620d956227797f6d2e1f4fb5f4b09b86d3c2be303b
SHA5126e7925228aaf4175a3c7f1e33131fdbcec9cdd9f40408933e7e607e0d6557ce92905ffe6dd90f6b73aaa38b1e769ad2966aacb375f2c660a4f7842dc5e013621
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TQ8Ny3fX.exeFilesize
1.0MB
MD58ca2811ee4fae71a570298ebc6efcbac
SHA1475da0caa3e4b5931344c9a739c46513edbe0830
SHA256803bdeb4bc4493002015ca620d956227797f6d2e1f4fb5f4b09b86d3c2be303b
SHA5126e7925228aaf4175a3c7f1e33131fdbcec9cdd9f40408933e7e607e0d6557ce92905ffe6dd90f6b73aaa38b1e769ad2966aacb375f2c660a4f7842dc5e013621
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yI0rw7Oy.exeFilesize
884KB
MD535cd0fa9a92632de1fb8f95616fbaf64
SHA154d2761ca84428640771282adb9157faaed6e027
SHA25632bc699ccaf4a011697be83dacd09a35d622910ec756259f5f88b12b8ebb2feb
SHA5122756154fed40d0c321f863ec2a8e433fb12351d436418daf7730cc1841641aa26a517ba9dbcbd8f640c5c64cee01b1f089518b5d4777e7cd47ebc9ffbb8b56e4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\yI0rw7Oy.exeFilesize
884KB
MD535cd0fa9a92632de1fb8f95616fbaf64
SHA154d2761ca84428640771282adb9157faaed6e027
SHA25632bc699ccaf4a011697be83dacd09a35d622910ec756259f5f88b12b8ebb2feb
SHA5122756154fed40d0c321f863ec2a8e433fb12351d436418daf7730cc1841641aa26a517ba9dbcbd8f640c5c64cee01b1f089518b5d4777e7cd47ebc9ffbb8b56e4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ou1po6co.exeFilesize
590KB
MD53a081b5e807cd77cc2ab1dd8be90b43f
SHA1950840587b5abce844724558485224ca5ed40c5a
SHA2566523b66313e8e95df0775befac10035f535ff46b85b23b68d611bff164f8c2db
SHA512a3abd35d1932ef8070725965f464612be246c38fea6cad04587fa74c1c3affc30cf78ddb9d19c31a68b0ee00cff6dcced40f786bab19acf921681eb212dfe553
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ou1po6co.exeFilesize
590KB
MD53a081b5e807cd77cc2ab1dd8be90b43f
SHA1950840587b5abce844724558485224ca5ed40c5a
SHA2566523b66313e8e95df0775befac10035f535ff46b85b23b68d611bff164f8c2db
SHA512a3abd35d1932ef8070725965f464612be246c38fea6cad04587fa74c1c3affc30cf78ddb9d19c31a68b0ee00cff6dcced40f786bab19acf921681eb212dfe553
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\SV7Lf3oJ.exeFilesize
417KB
MD53d7f340b03b8668120c515eebb21d8e5
SHA1b6cdff303bc0e96b55684ef7b7b96466e14ee982
SHA2566b384a445d0a676ec844ef800f820fc0cfb7f0ef8b25d8e2554c823970a34dc1
SHA512027875ae8292b0e223ee920c57d578623a3b2140475a5f69b4a495d16a1bb142f57943c22f70fb061cf0acc7f2f730a50ae8221743df81449995eb7061fa2869
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\SV7Lf3oJ.exeFilesize
417KB
MD53d7f340b03b8668120c515eebb21d8e5
SHA1b6cdff303bc0e96b55684ef7b7b96466e14ee982
SHA2566b384a445d0a676ec844ef800f820fc0cfb7f0ef8b25d8e2554c823970a34dc1
SHA512027875ae8292b0e223ee920c57d578623a3b2140475a5f69b4a495d16a1bb142f57943c22f70fb061cf0acc7f2f730a50ae8221743df81449995eb7061fa2869
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KW20JF5.exeFilesize
378KB
MD5f0831f173733de08511f3a0739f278a6
SHA106dc809d653c5d2c97386084ae13b50a73eb5b60
SHA2568b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
SHA51219e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1KW20JF5.exeFilesize
378KB
MD5f0831f173733de08511f3a0739f278a6
SHA106dc809d653c5d2c97386084ae13b50a73eb5b60
SHA2568b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
SHA51219e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2mE712ld.exeFilesize
231KB
MD58073d2d3ebad6d4e30393d475a92bb86
SHA1c51ad178741c1f75c5315236c66dd3acb1350c86
SHA256956c4bdf9fe0e4700e8158dd17661ffebfda29f11dfe720ecea5a9605ac3bd66
SHA512159e3ca8e7d7de6004b4fca384d31839a1d79ff31722f617c7f044afb4d772646dbcabcd80d2af92603c3d707091e58012928b6350d9e9f4bf4513cb16036203
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2mE712ld.exeFilesize
231KB
MD58073d2d3ebad6d4e30393d475a92bb86
SHA1c51ad178741c1f75c5315236c66dd3acb1350c86
SHA256956c4bdf9fe0e4700e8158dd17661ffebfda29f11dfe720ecea5a9605ac3bd66
SHA512159e3ca8e7d7de6004b4fca384d31839a1d79ff31722f617c7f044afb4d772646dbcabcd80d2af92603c3d707091e58012928b6350d9e9f4bf4513cb16036203
-
memory/2840-36-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2840-37-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2840-39-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2840-35-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3440-46-0x00000000071C0000-0x0000000007252000-memory.dmpFilesize
584KB
-
memory/3440-43-0x00000000003E0000-0x000000000041E000-memory.dmpFilesize
248KB
-
memory/3440-45-0x00000000076D0000-0x0000000007C74000-memory.dmpFilesize
5.6MB
-
memory/3440-44-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/3440-47-0x0000000007150000-0x0000000007160000-memory.dmpFilesize
64KB
-
memory/3440-48-0x0000000007360000-0x000000000736A000-memory.dmpFilesize
40KB
-
memory/3440-49-0x00000000082A0000-0x00000000088B8000-memory.dmpFilesize
6.1MB
-
memory/3440-50-0x0000000007510000-0x000000000761A000-memory.dmpFilesize
1.0MB
-
memory/3440-51-0x0000000007440000-0x0000000007452000-memory.dmpFilesize
72KB
-
memory/3440-52-0x00000000074A0000-0x00000000074DC000-memory.dmpFilesize
240KB
-
memory/3440-53-0x0000000007620000-0x000000000766C000-memory.dmpFilesize
304KB
-
memory/3440-54-0x00000000748E0000-0x0000000075090000-memory.dmpFilesize
7.7MB
-
memory/3440-55-0x0000000007150000-0x0000000007160000-memory.dmpFilesize
64KB