Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/10/2023, 12:34

General

  • Target

    NEAS.78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915_JC.exe

  • Size

    1.2MB

  • MD5

    abb7f8218366424a14a301054fc2ed57

  • SHA1

    7f4884c03fa7103606b7ae4e2b90b1d2f133c6de

  • SHA256

    78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915

  • SHA512

    272a0dfe6d314f0c0d11b294e61ca295487883b2efea846182ed486d62463bfa26a315ee964d1591a91bdd69c8118ca5125cec6a1b9ed0fdc20e525a278ef947

  • SSDEEP

    24576:jymuXXxHJ27jd+Rdmkr84+TVkhuBFTj+x3Cmo5bpr1gEJ2:2mun727R+vrr9A+xymGpr1P

Malware Config

Extracted

Family

redline

Botnet

gigant

C2

77.91.124.55:19071

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915_JC.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4608
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1720
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:820
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4024
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                  PID:3860
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                  7⤵
                    PID:4624
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 4624 -s 540
                      8⤵
                      • Program crash
                      PID:1316
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 140
                    7⤵
                    • Program crash
                    PID:1724
                • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2MV608TZ.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2MV608TZ.exe
                  6⤵
                  • Executes dropped EXE
                  PID:2552
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4024 -ip 4024
        1⤵
          PID:3176
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4624 -ip 4624
          1⤵
            PID:4036

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe

            Filesize

            1.0MB

            MD5

            a1c095e45a0b6da572598ef9c33f6089

            SHA1

            e4bdb84695b0a9db2794c26564f6b3639265dcec

            SHA256

            3dafd1c231623b4b65d76c167a8d92704983238cb4aed68a779360d8ef05123b

            SHA512

            5a3c7b5b341acba103a323ea4478e2aac17d253505025b1e4a8ecdb261832374056bd929e0deae15bd07a20480b5df448d06e511ac3b5895709d852698bc700e

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe

            Filesize

            1.0MB

            MD5

            a1c095e45a0b6da572598ef9c33f6089

            SHA1

            e4bdb84695b0a9db2794c26564f6b3639265dcec

            SHA256

            3dafd1c231623b4b65d76c167a8d92704983238cb4aed68a779360d8ef05123b

            SHA512

            5a3c7b5b341acba103a323ea4478e2aac17d253505025b1e4a8ecdb261832374056bd929e0deae15bd07a20480b5df448d06e511ac3b5895709d852698bc700e

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe

            Filesize

            884KB

            MD5

            ad819fd2029df5dd620823ced7b665b6

            SHA1

            006a40c51bb81393ddc1b783094bbab02bdea40b

            SHA256

            7046ce53a440d1b8b0d6e66b8318be07fbeb7247f7763edc9a80b4daf9b01bd5

            SHA512

            75581eb0b5eb76bcbf813eb6e28a513fad3e10f6bef6c337ee72e7d7fb115539ef33d94ea16f6caade4e134042604db300edd6d819f6d6bef5f0108832889aa5

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe

            Filesize

            884KB

            MD5

            ad819fd2029df5dd620823ced7b665b6

            SHA1

            006a40c51bb81393ddc1b783094bbab02bdea40b

            SHA256

            7046ce53a440d1b8b0d6e66b8318be07fbeb7247f7763edc9a80b4daf9b01bd5

            SHA512

            75581eb0b5eb76bcbf813eb6e28a513fad3e10f6bef6c337ee72e7d7fb115539ef33d94ea16f6caade4e134042604db300edd6d819f6d6bef5f0108832889aa5

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe

            Filesize

            590KB

            MD5

            6ff6f59572e911314649d156c6548097

            SHA1

            9d05079ae5f8c2b84067a794e604ac8058daba79

            SHA256

            ffe72c96ccd0a4387ccd3de954dd570103ef02596f61522622e2f064d44100fb

            SHA512

            1503a6278bdbfb778e58842c0c793da7c604ddc4bd172809571880cd60b06b243c61e53596464fc5b9869418f3082c768e7a67270c21cf553cce35dcbf271166

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe

            Filesize

            590KB

            MD5

            6ff6f59572e911314649d156c6548097

            SHA1

            9d05079ae5f8c2b84067a794e604ac8058daba79

            SHA256

            ffe72c96ccd0a4387ccd3de954dd570103ef02596f61522622e2f064d44100fb

            SHA512

            1503a6278bdbfb778e58842c0c793da7c604ddc4bd172809571880cd60b06b243c61e53596464fc5b9869418f3082c768e7a67270c21cf553cce35dcbf271166

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe

            Filesize

            417KB

            MD5

            b81c6566a86ba4a9e4306c26e5baa9c8

            SHA1

            779b73cfedf3b57a76f864f1627aa0d29c794419

            SHA256

            0febaf03222ad3abf0405f14154ae39df890f6bb73d6ad97bfe55901f9bdc434

            SHA512

            a7321204f4125e40a2919f0a9db48493e52105eba6d408f5c0f495493e5bfe0a5a924f44b7d95899a21c0d0f6a4d7300c4fbd121477b49e9555ef8b3656002ec

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe

            Filesize

            417KB

            MD5

            b81c6566a86ba4a9e4306c26e5baa9c8

            SHA1

            779b73cfedf3b57a76f864f1627aa0d29c794419

            SHA256

            0febaf03222ad3abf0405f14154ae39df890f6bb73d6ad97bfe55901f9bdc434

            SHA512

            a7321204f4125e40a2919f0a9db48493e52105eba6d408f5c0f495493e5bfe0a5a924f44b7d95899a21c0d0f6a4d7300c4fbd121477b49e9555ef8b3656002ec

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

            Filesize

            378KB

            MD5

            f0831f173733de08511f3a0739f278a6

            SHA1

            06dc809d653c5d2c97386084ae13b50a73eb5b60

            SHA256

            8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

            SHA512

            19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

            Filesize

            378KB

            MD5

            f0831f173733de08511f3a0739f278a6

            SHA1

            06dc809d653c5d2c97386084ae13b50a73eb5b60

            SHA256

            8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

            SHA512

            19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2MV608TZ.exe

            Filesize

            231KB

            MD5

            b5198d0881cbc6675de0d05fcbbd356d

            SHA1

            9c17c52f163b538f7cdd5fe93116fd5bd1d925bd

            SHA256

            2a858f8b24732a5d84ff4f7fa0967e91f2c402ea5b6faeb8da76323834ea8c7c

            SHA512

            32c605e0bf60658a89763063fe80dcbe836cc36964400002f7096f7c5d713460a64a6e871046bc3eb5db9ae53827ed29626ab860a94186dfe74202811b3201d2

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2MV608TZ.exe

            Filesize

            231KB

            MD5

            b5198d0881cbc6675de0d05fcbbd356d

            SHA1

            9c17c52f163b538f7cdd5fe93116fd5bd1d925bd

            SHA256

            2a858f8b24732a5d84ff4f7fa0967e91f2c402ea5b6faeb8da76323834ea8c7c

            SHA512

            32c605e0bf60658a89763063fe80dcbe836cc36964400002f7096f7c5d713460a64a6e871046bc3eb5db9ae53827ed29626ab860a94186dfe74202811b3201d2

          • memory/2552-46-0x0000000007070000-0x0000000007102000-memory.dmp

            Filesize

            584KB

          • memory/2552-48-0x0000000004BC0000-0x0000000004BCA000-memory.dmp

            Filesize

            40KB

          • memory/2552-55-0x0000000007230000-0x0000000007240000-memory.dmp

            Filesize

            64KB

          • memory/2552-54-0x0000000074690000-0x0000000074E40000-memory.dmp

            Filesize

            7.7MB

          • memory/2552-43-0x0000000074690000-0x0000000074E40000-memory.dmp

            Filesize

            7.7MB

          • memory/2552-44-0x0000000000270000-0x00000000002AE000-memory.dmp

            Filesize

            248KB

          • memory/2552-45-0x0000000007620000-0x0000000007BC4000-memory.dmp

            Filesize

            5.6MB

          • memory/2552-53-0x00000000074B0000-0x00000000074FC000-memory.dmp

            Filesize

            304KB

          • memory/2552-52-0x0000000007320000-0x000000000735C000-memory.dmp

            Filesize

            240KB

          • memory/2552-49-0x00000000081F0000-0x0000000008808000-memory.dmp

            Filesize

            6.1MB

          • memory/2552-47-0x0000000007230000-0x0000000007240000-memory.dmp

            Filesize

            64KB

          • memory/2552-50-0x00000000073A0000-0x00000000074AA000-memory.dmp

            Filesize

            1.0MB

          • memory/2552-51-0x00000000072C0000-0x00000000072D2000-memory.dmp

            Filesize

            72KB

          • memory/4624-39-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/4624-36-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/4624-37-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/4624-35-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB