Analysis
-
max time kernel
153s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2023 12:13
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe
-
Size
1.2MB
-
MD5
919b359a73a034bd1742a3846ce1332d
-
SHA1
e82d56a9aeeb2b8a4568b7bd86d94f8ad4565e13
-
SHA256
63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8
-
SHA512
c5893022d530cfa36dbd8b7eb7aa45655caaee99f64bc456dfa0d8147e5d09afd49835804f4287e7cdb0b64a5850010b78e34c9f0ca0d36c19c4bbc677878f2a
-
SSDEEP
24576:9y2CyMEv4qZAina4sIgXajxFCv0RuSR8Ghl3GSKc5yDIEGAMT:Y2CyMQ5lgSxFJRuNcG45yDIEtM
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3828-35-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3828-36-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3828-37-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3828-39-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Za650ia.exe family_redline C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Za650ia.exe family_redline behavioral2/memory/3084-44-0x00000000007C0000-0x00000000007FE000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
cr1JE3um.exeFC6tv4md.exeTN9LK8kk.exeJl7FN3zr.exe1Zg42Ch1.exe2Za650ia.exepid process 4432 cr1JE3um.exe 1236 FC6tv4md.exe 4484 TN9LK8kk.exe 4064 Jl7FN3zr.exe 4740 1Zg42Ch1.exe 3084 2Za650ia.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.execr1JE3um.exeFC6tv4md.exeTN9LK8kk.exeJl7FN3zr.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" cr1JE3um.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" FC6tv4md.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" TN9LK8kk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" Jl7FN3zr.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1Zg42Ch1.exedescription pid process target process PID 4740 set thread context of 3828 4740 1Zg42Ch1.exe AppLaunch.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 364 3828 WerFault.exe AppLaunch.exe 1248 4740 WerFault.exe 1Zg42Ch1.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.execr1JE3um.exeFC6tv4md.exeTN9LK8kk.exeJl7FN3zr.exe1Zg42Ch1.exedescription pid process target process PID 1060 wrote to memory of 4432 1060 NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe cr1JE3um.exe PID 1060 wrote to memory of 4432 1060 NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe cr1JE3um.exe PID 1060 wrote to memory of 4432 1060 NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe cr1JE3um.exe PID 4432 wrote to memory of 1236 4432 cr1JE3um.exe FC6tv4md.exe PID 4432 wrote to memory of 1236 4432 cr1JE3um.exe FC6tv4md.exe PID 4432 wrote to memory of 1236 4432 cr1JE3um.exe FC6tv4md.exe PID 1236 wrote to memory of 4484 1236 FC6tv4md.exe TN9LK8kk.exe PID 1236 wrote to memory of 4484 1236 FC6tv4md.exe TN9LK8kk.exe PID 1236 wrote to memory of 4484 1236 FC6tv4md.exe TN9LK8kk.exe PID 4484 wrote to memory of 4064 4484 TN9LK8kk.exe Jl7FN3zr.exe PID 4484 wrote to memory of 4064 4484 TN9LK8kk.exe Jl7FN3zr.exe PID 4484 wrote to memory of 4064 4484 TN9LK8kk.exe Jl7FN3zr.exe PID 4064 wrote to memory of 4740 4064 Jl7FN3zr.exe 1Zg42Ch1.exe PID 4064 wrote to memory of 4740 4064 Jl7FN3zr.exe 1Zg42Ch1.exe PID 4064 wrote to memory of 4740 4064 Jl7FN3zr.exe 1Zg42Ch1.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4740 wrote to memory of 3828 4740 1Zg42Ch1.exe AppLaunch.exe PID 4064 wrote to memory of 3084 4064 Jl7FN3zr.exe 2Za650ia.exe PID 4064 wrote to memory of 3084 4064 Jl7FN3zr.exe 2Za650ia.exe PID 4064 wrote to memory of 3084 4064 Jl7FN3zr.exe 2Za650ia.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.63e6b5c83075ac978e67dd3e333b3a73cf6c4d1c644a3e8975acdc6fb9c7c1f8_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cr1JE3um.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cr1JE3um.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FC6tv4md.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FC6tv4md.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TN9LK8kk.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TN9LK8kk.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Jl7FN3zr.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Jl7FN3zr.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Zg42Ch1.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Zg42Ch1.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 1487⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Za650ia.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Za650ia.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3828 -ip 38281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4740 -ip 47401⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cr1JE3um.exeFilesize
1.0MB
MD54b07af558f84910eaa3d63763854b3e3
SHA14c13004bd5bdbca5be2e91632996199dfe587bc8
SHA25611afd9400bf51a5548304406f5fc99260b81665b8a524cdc2f66fa2c599eea4f
SHA512ec9c20e9fcb88514f1b496f63ebf8d37848497b13043f409a0f890af8e7100f0f6410ee0250790ff666f8ae2458750aeab9ff760bdaf568b5e86b4f42a6a6740
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cr1JE3um.exeFilesize
1.0MB
MD54b07af558f84910eaa3d63763854b3e3
SHA14c13004bd5bdbca5be2e91632996199dfe587bc8
SHA25611afd9400bf51a5548304406f5fc99260b81665b8a524cdc2f66fa2c599eea4f
SHA512ec9c20e9fcb88514f1b496f63ebf8d37848497b13043f409a0f890af8e7100f0f6410ee0250790ff666f8ae2458750aeab9ff760bdaf568b5e86b4f42a6a6740
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FC6tv4md.exeFilesize
884KB
MD5d0a38fd572892b5ca6bc0cccfcfff8cd
SHA1b70a6403e5445444242fa96f3535a085ab676411
SHA2560a2c6fe1b3cdd539a17485257f3bad773b652f7099c83e35dda9ee2f75fea5a9
SHA512cf85778b76bfb4047ffba4bae8dbc5aa46de04144ef8358d6d08528e8d115d6983e32e971cc85e8fd78a8ae197e4771b3693641d5c686cb1409e95a2b3a7def1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\FC6tv4md.exeFilesize
884KB
MD5d0a38fd572892b5ca6bc0cccfcfff8cd
SHA1b70a6403e5445444242fa96f3535a085ab676411
SHA2560a2c6fe1b3cdd539a17485257f3bad773b652f7099c83e35dda9ee2f75fea5a9
SHA512cf85778b76bfb4047ffba4bae8dbc5aa46de04144ef8358d6d08528e8d115d6983e32e971cc85e8fd78a8ae197e4771b3693641d5c686cb1409e95a2b3a7def1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TN9LK8kk.exeFilesize
590KB
MD55ced63ca97659399d379b8ab208033e6
SHA104cbd7f0d3c79620d57da28547a002d4377954b1
SHA25665d23f369e1f103ea46705583dc94ff6fe4768ef7ab61d2668f2b1ac9ff29179
SHA512b4f13b172a7aece43ab74fb9e9897cf69c7edddbf3757d06355c8b4977d359a0e68f6b9b2a56e6220e926a54eef0126d0c0029e3c39105c8c97db1e7d296efba
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\TN9LK8kk.exeFilesize
590KB
MD55ced63ca97659399d379b8ab208033e6
SHA104cbd7f0d3c79620d57da28547a002d4377954b1
SHA25665d23f369e1f103ea46705583dc94ff6fe4768ef7ab61d2668f2b1ac9ff29179
SHA512b4f13b172a7aece43ab74fb9e9897cf69c7edddbf3757d06355c8b4977d359a0e68f6b9b2a56e6220e926a54eef0126d0c0029e3c39105c8c97db1e7d296efba
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Jl7FN3zr.exeFilesize
417KB
MD5cbc6cdbc6ed4cb4e6f707ca035388888
SHA1cd267c98c8e32810d7d24012e63ad14a07493956
SHA256197f85851b15bbe9c2154c2c7a2d40bcaa96fcf4fb46db5402a01d972c83de10
SHA512d45441959e5302fefcd5c03d8dc9576c4bd7816758781e5cc60a06cbeefe898aaf4bec56dcf07f500049180615ab940e7e7b408c6636d83c779fd4ae2e6dfcc7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Jl7FN3zr.exeFilesize
417KB
MD5cbc6cdbc6ed4cb4e6f707ca035388888
SHA1cd267c98c8e32810d7d24012e63ad14a07493956
SHA256197f85851b15bbe9c2154c2c7a2d40bcaa96fcf4fb46db5402a01d972c83de10
SHA512d45441959e5302fefcd5c03d8dc9576c4bd7816758781e5cc60a06cbeefe898aaf4bec56dcf07f500049180615ab940e7e7b408c6636d83c779fd4ae2e6dfcc7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Zg42Ch1.exeFilesize
378KB
MD52f4bdedb6ad8bea59b3effee4b867f07
SHA1cfa2376e4fe3c7cb998104eba4bb78e58e9b59c7
SHA2568b0d0ed4daa91634ee6554113d721a661dbacc9a82ed52ea23bd863c88a794c0
SHA512f60afc332fc497e9e9bb9422b5d69f592617e37674131e74825d60ce2e3b3f9453acb9bba1b7b3d9761c5e8078ece8a9fe1e935b4d5383cbb85e6ac5237c3ca8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Zg42Ch1.exeFilesize
378KB
MD52f4bdedb6ad8bea59b3effee4b867f07
SHA1cfa2376e4fe3c7cb998104eba4bb78e58e9b59c7
SHA2568b0d0ed4daa91634ee6554113d721a661dbacc9a82ed52ea23bd863c88a794c0
SHA512f60afc332fc497e9e9bb9422b5d69f592617e37674131e74825d60ce2e3b3f9453acb9bba1b7b3d9761c5e8078ece8a9fe1e935b4d5383cbb85e6ac5237c3ca8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Za650ia.exeFilesize
231KB
MD58f9802dc7b6f6e93ec6a66411bdbe032
SHA142527fbff798ca747257573028ceebb7c9b5511d
SHA256ef4e9ad7ac8337a48451fc2abf251f4bc478381a72787fbcef58c97ea10578f4
SHA512724c38fd5552d1a2caa0c3a725317d4c3e1ec61fae9feb22e56cd00c0b02936763a5774cc0e5b8f36afb956a73637b6195e6091faf1af6f039fb5ef743d497f4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Za650ia.exeFilesize
231KB
MD58f9802dc7b6f6e93ec6a66411bdbe032
SHA142527fbff798ca747257573028ceebb7c9b5511d
SHA256ef4e9ad7ac8337a48451fc2abf251f4bc478381a72787fbcef58c97ea10578f4
SHA512724c38fd5552d1a2caa0c3a725317d4c3e1ec61fae9feb22e56cd00c0b02936763a5774cc0e5b8f36afb956a73637b6195e6091faf1af6f039fb5ef743d497f4
-
memory/3084-46-0x0000000007550000-0x00000000075E2000-memory.dmpFilesize
584KB
-
memory/3084-43-0x0000000074540000-0x0000000074CF0000-memory.dmpFilesize
7.7MB
-
memory/3084-47-0x0000000007540000-0x0000000007550000-memory.dmpFilesize
64KB
-
memory/3084-55-0x0000000007540000-0x0000000007550000-memory.dmpFilesize
64KB
-
memory/3084-48-0x0000000007650000-0x000000000765A000-memory.dmpFilesize
40KB
-
memory/3084-44-0x00000000007C0000-0x00000000007FE000-memory.dmpFilesize
248KB
-
memory/3084-45-0x0000000007A60000-0x0000000008004000-memory.dmpFilesize
5.6MB
-
memory/3084-49-0x0000000008630000-0x0000000008C48000-memory.dmpFilesize
6.1MB
-
memory/3084-54-0x0000000074540000-0x0000000074CF0000-memory.dmpFilesize
7.7MB
-
memory/3084-53-0x0000000007A00000-0x0000000007A4C000-memory.dmpFilesize
304KB
-
memory/3084-52-0x0000000007880000-0x00000000078BC000-memory.dmpFilesize
240KB
-
memory/3084-50-0x00000000078F0000-0x00000000079FA000-memory.dmpFilesize
1.0MB
-
memory/3084-51-0x0000000007820000-0x0000000007832000-memory.dmpFilesize
72KB
-
memory/3828-36-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3828-39-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3828-35-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3828-37-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB