Analysis
-
max time kernel
156s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2023 11:59
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe
-
Size
1.2MB
-
MD5
bdf7fc6e400c2bc8dafca00732a7b259
-
SHA1
75ba29a05598998dca24bb52c7d311a6fe219c48
-
SHA256
526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7
-
SHA512
e13ce7b519e6da87493183e2699f38e5171359e8a824074e6d6e92ba1ad9d29b87db2ece73a79156168741e681728122bef2f666fc274deaf5c5306c41b476d0
-
SSDEEP
24576:7yWodOfzIjZJXcoF7shLxvqA1UcHD7qHINivyoma19je:uWvIZdrF7s1xvqKHD7qHIIvyDa19
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3260-35-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3260-36-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3260-37-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3260-39-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mm690BL.exe family_redline C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mm690BL.exe family_redline behavioral2/memory/1896-44-0x0000000000A80000-0x0000000000ABE000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
np0kT0LJ.exePt8iu6Yp.exeXE8tc0Nc.exeGw0Ca5xM.exe1WV96ea9.exe2Mm690BL.exepid process 2416 np0kT0LJ.exe 4652 Pt8iu6Yp.exe 4832 XE8tc0Nc.exe 4732 Gw0Ca5xM.exe 2068 1WV96ea9.exe 1896 2Mm690BL.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exenp0kT0LJ.exePt8iu6Yp.exeXE8tc0Nc.exeGw0Ca5xM.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" np0kT0LJ.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Pt8iu6Yp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" XE8tc0Nc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" Gw0Ca5xM.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1WV96ea9.exedescription pid process target process PID 2068 set thread context of 3260 2068 1WV96ea9.exe AppLaunch.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4152 3260 WerFault.exe AppLaunch.exe 1744 2068 WerFault.exe 1WV96ea9.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exenp0kT0LJ.exePt8iu6Yp.exeXE8tc0Nc.exeGw0Ca5xM.exe1WV96ea9.exedescription pid process target process PID 2768 wrote to memory of 2416 2768 NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe np0kT0LJ.exe PID 2768 wrote to memory of 2416 2768 NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe np0kT0LJ.exe PID 2768 wrote to memory of 2416 2768 NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe np0kT0LJ.exe PID 2416 wrote to memory of 4652 2416 np0kT0LJ.exe Pt8iu6Yp.exe PID 2416 wrote to memory of 4652 2416 np0kT0LJ.exe Pt8iu6Yp.exe PID 2416 wrote to memory of 4652 2416 np0kT0LJ.exe Pt8iu6Yp.exe PID 4652 wrote to memory of 4832 4652 Pt8iu6Yp.exe XE8tc0Nc.exe PID 4652 wrote to memory of 4832 4652 Pt8iu6Yp.exe XE8tc0Nc.exe PID 4652 wrote to memory of 4832 4652 Pt8iu6Yp.exe XE8tc0Nc.exe PID 4832 wrote to memory of 4732 4832 XE8tc0Nc.exe Gw0Ca5xM.exe PID 4832 wrote to memory of 4732 4832 XE8tc0Nc.exe Gw0Ca5xM.exe PID 4832 wrote to memory of 4732 4832 XE8tc0Nc.exe Gw0Ca5xM.exe PID 4732 wrote to memory of 2068 4732 Gw0Ca5xM.exe 1WV96ea9.exe PID 4732 wrote to memory of 2068 4732 Gw0Ca5xM.exe 1WV96ea9.exe PID 4732 wrote to memory of 2068 4732 Gw0Ca5xM.exe 1WV96ea9.exe PID 2068 wrote to memory of 3096 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3096 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3096 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 2068 wrote to memory of 3260 2068 1WV96ea9.exe AppLaunch.exe PID 4732 wrote to memory of 1896 4732 Gw0Ca5xM.exe 2Mm690BL.exe PID 4732 wrote to memory of 1896 4732 Gw0Ca5xM.exe 2Mm690BL.exe PID 4732 wrote to memory of 1896 4732 Gw0Ca5xM.exe 2Mm690BL.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.526be697bff16798a7b0db1272f29ee6e6e4a0d2f8779f857ebe162729e247a7_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\np0kT0LJ.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\np0kT0LJ.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pt8iu6Yp.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pt8iu6Yp.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE8tc0Nc.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE8tc0Nc.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Gw0Ca5xM.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Gw0Ca5xM.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1WV96ea9.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1WV96ea9.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 2088⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 1527⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mm690BL.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mm690BL.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3260 -ip 32601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2068 -ip 20681⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\np0kT0LJ.exeFilesize
1.0MB
MD538d4617642d991ba91c8022248965256
SHA1be9a7449109bb0e49868e000b58582b9d12cf694
SHA2569be23839da2d01429bafced3c98a522008198bc52811b5e3876ad0d5def4b899
SHA512171cda5184c0350f522f3c5a509df5ca545bbe2619831fdbe29c7658e9ab03a25773e5efdd7a690edcb47277e85c385cdd89ebfce9d7a5c0d831c897d30bac59
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\np0kT0LJ.exeFilesize
1.0MB
MD538d4617642d991ba91c8022248965256
SHA1be9a7449109bb0e49868e000b58582b9d12cf694
SHA2569be23839da2d01429bafced3c98a522008198bc52811b5e3876ad0d5def4b899
SHA512171cda5184c0350f522f3c5a509df5ca545bbe2619831fdbe29c7658e9ab03a25773e5efdd7a690edcb47277e85c385cdd89ebfce9d7a5c0d831c897d30bac59
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pt8iu6Yp.exeFilesize
883KB
MD5b1b28885f23879361301c0be47a9eb92
SHA13dec5992819a7e3f21ed1e40176acff72e1681c6
SHA256539969d819fb8e1b7ac3dfabc3a5a1de81d6dcfb64a458986fb33c300f17bbba
SHA51229bbb12bcc25feb8f7c08252711a909bf61db9af43dd269226163dcd51428ed2c5abe7b78d6d32652895469c1972fe1c2cdec6cb6fdbb433f9785f188d0c8dd0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Pt8iu6Yp.exeFilesize
883KB
MD5b1b28885f23879361301c0be47a9eb92
SHA13dec5992819a7e3f21ed1e40176acff72e1681c6
SHA256539969d819fb8e1b7ac3dfabc3a5a1de81d6dcfb64a458986fb33c300f17bbba
SHA51229bbb12bcc25feb8f7c08252711a909bf61db9af43dd269226163dcd51428ed2c5abe7b78d6d32652895469c1972fe1c2cdec6cb6fdbb433f9785f188d0c8dd0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE8tc0Nc.exeFilesize
590KB
MD54731613dbaf4d2a2f6714f902936f034
SHA19a6d29ffd939e978af62e2e06033b2f4f280017e
SHA2565dab0bf3bb1da6ff8f153d076bb74e62deae5b8ff5290f417f14528c3f4205eb
SHA512e88d8f6b43f34f96e5e3be66be09a8fbe23efbf4107ad3123cf7c860fa6766482b451e90f631ce7cfa417bd8ae4fda306d737562a44c068d3cdecbdbd3c71c70
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\XE8tc0Nc.exeFilesize
590KB
MD54731613dbaf4d2a2f6714f902936f034
SHA19a6d29ffd939e978af62e2e06033b2f4f280017e
SHA2565dab0bf3bb1da6ff8f153d076bb74e62deae5b8ff5290f417f14528c3f4205eb
SHA512e88d8f6b43f34f96e5e3be66be09a8fbe23efbf4107ad3123cf7c860fa6766482b451e90f631ce7cfa417bd8ae4fda306d737562a44c068d3cdecbdbd3c71c70
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Gw0Ca5xM.exeFilesize
417KB
MD5a9e032e8b840ba9be29467b2cec7d064
SHA12e75b73ee8159cbd272d4d07bb9cc42a518dd9fe
SHA256bc1821a8177193e2638ad6fa7a7844079d80a8d61688d6799bc0e19c973151a7
SHA5122cfbd1b76da96b8756b2e28b4616765e370cf07b7f503f525f3b35624701c6c1ceeca1a8c7ed498926b10d21236311f6c49c6887e7ed90a4d0e619a581cd6c3b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Gw0Ca5xM.exeFilesize
417KB
MD5a9e032e8b840ba9be29467b2cec7d064
SHA12e75b73ee8159cbd272d4d07bb9cc42a518dd9fe
SHA256bc1821a8177193e2638ad6fa7a7844079d80a8d61688d6799bc0e19c973151a7
SHA5122cfbd1b76da96b8756b2e28b4616765e370cf07b7f503f525f3b35624701c6c1ceeca1a8c7ed498926b10d21236311f6c49c6887e7ed90a4d0e619a581cd6c3b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1WV96ea9.exeFilesize
378KB
MD56b0426968d436077c45be812c9236a06
SHA19d7566f494a88d09e7b31f0765aba2c54dd96eef
SHA256d4046bab99dd1b244fe36b24db2a13cc9db5bc35a25c530a5b84a14839d9f169
SHA5129856e1bc3407e074a26163fec15ea54d49ec91e49b8df265133ecf527109bdb1a06f55656ff6e8a4b5fd48e402ed73ec1a0f3ef66cebd626f6f06d1e91c39fbb
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1WV96ea9.exeFilesize
378KB
MD56b0426968d436077c45be812c9236a06
SHA19d7566f494a88d09e7b31f0765aba2c54dd96eef
SHA256d4046bab99dd1b244fe36b24db2a13cc9db5bc35a25c530a5b84a14839d9f169
SHA5129856e1bc3407e074a26163fec15ea54d49ec91e49b8df265133ecf527109bdb1a06f55656ff6e8a4b5fd48e402ed73ec1a0f3ef66cebd626f6f06d1e91c39fbb
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mm690BL.exeFilesize
231KB
MD5932d7df73b1dfbcfec4858f5af30329a
SHA164381a37d9909d026d80ef7092994693d3a6e593
SHA256df254302a4798401b269840c1157238c3b5acd34fe70741d480b0227a317a6f0
SHA512c7dedf391760386acec3f4c8dbeec28c5cdf4a4b1468f4bec045c7f0b781c786cd6c80ea410abf62dbd1ad488532d0c598e6b0c470b555d70a50ca407a85ffd8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Mm690BL.exeFilesize
231KB
MD5932d7df73b1dfbcfec4858f5af30329a
SHA164381a37d9909d026d80ef7092994693d3a6e593
SHA256df254302a4798401b269840c1157238c3b5acd34fe70741d480b0227a317a6f0
SHA512c7dedf391760386acec3f4c8dbeec28c5cdf4a4b1468f4bec045c7f0b781c786cd6c80ea410abf62dbd1ad488532d0c598e6b0c470b555d70a50ca407a85ffd8
-
memory/1896-46-0x0000000007870000-0x0000000007902000-memory.dmpFilesize
584KB
-
memory/1896-43-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/1896-47-0x0000000074860000-0x0000000075010000-memory.dmpFilesize
7.7MB
-
memory/1896-55-0x0000000007B00000-0x0000000007B10000-memory.dmpFilesize
64KB
-
memory/1896-48-0x0000000007B00000-0x0000000007B10000-memory.dmpFilesize
64KB
-
memory/1896-44-0x0000000000A80000-0x0000000000ABE000-memory.dmpFilesize
248KB
-
memory/1896-45-0x0000000007D80000-0x0000000008324000-memory.dmpFilesize
5.6MB
-
memory/1896-49-0x0000000007860000-0x000000000786A000-memory.dmpFilesize
40KB
-
memory/1896-54-0x0000000007B90000-0x0000000007BDC000-memory.dmpFilesize
304KB
-
memory/1896-53-0x0000000007B50000-0x0000000007B8C000-memory.dmpFilesize
240KB
-
memory/1896-52-0x0000000007AE0000-0x0000000007AF2000-memory.dmpFilesize
72KB
-
memory/1896-50-0x0000000008950000-0x0000000008F68000-memory.dmpFilesize
6.1MB
-
memory/1896-51-0x0000000007C20000-0x0000000007D2A000-memory.dmpFilesize
1.0MB
-
memory/3260-36-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3260-39-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3260-35-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3260-37-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB