Analysis
-
max time kernel
142s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2023 13:50
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe
-
Size
1.2MB
-
MD5
7a37d9200f1b26ef38d83fc8bab95593
-
SHA1
805048f58107db04ecb7fb403a31132adb8d72bf
-
SHA256
df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a
-
SHA512
170043c934432aa19938f312f3ab83a13561794c9514e19f6610122aa6ac07a80baaf0496eaaa497e92d1006be3c31f4e2a7d8b3a6eacafc3b862d4dd0e6b8bb
-
SSDEEP
24576:xyu7A5IXxBE1i1pHeD+6ryVXA8u7+SAoZl+2tf9J4VD:kuA5IBWo1pH+YZuq1W+F
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4764-35-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4764-36-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4764-37-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4764-39-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2NM322Sp.exe family_redline C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2NM322Sp.exe family_redline behavioral2/memory/4688-43-0x00000000001A0000-0x00000000001DE000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
Mt9qp2jg.exeSd8RQ8kX.exesk0aN7Be.exeEr3iM5Xh.exe1DW33ET8.exe2NM322Sp.exepid process 2288 Mt9qp2jg.exe 2832 Sd8RQ8kX.exe 772 sk0aN7Be.exe 4308 Er3iM5Xh.exe 548 1DW33ET8.exe 4688 2NM322Sp.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
Er3iM5Xh.exeNEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exeMt9qp2jg.exeSd8RQ8kX.exesk0aN7Be.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" Er3iM5Xh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Mt9qp2jg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Sd8RQ8kX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" sk0aN7Be.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1DW33ET8.exedescription pid process target process PID 548 set thread context of 4764 548 1DW33ET8.exe AppLaunch.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3792 4764 WerFault.exe AppLaunch.exe 688 548 WerFault.exe 1DW33ET8.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exeMt9qp2jg.exeSd8RQ8kX.exesk0aN7Be.exeEr3iM5Xh.exe1DW33ET8.exedescription pid process target process PID 1308 wrote to memory of 2288 1308 NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe Mt9qp2jg.exe PID 1308 wrote to memory of 2288 1308 NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe Mt9qp2jg.exe PID 1308 wrote to memory of 2288 1308 NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe Mt9qp2jg.exe PID 2288 wrote to memory of 2832 2288 Mt9qp2jg.exe Sd8RQ8kX.exe PID 2288 wrote to memory of 2832 2288 Mt9qp2jg.exe Sd8RQ8kX.exe PID 2288 wrote to memory of 2832 2288 Mt9qp2jg.exe Sd8RQ8kX.exe PID 2832 wrote to memory of 772 2832 Sd8RQ8kX.exe sk0aN7Be.exe PID 2832 wrote to memory of 772 2832 Sd8RQ8kX.exe sk0aN7Be.exe PID 2832 wrote to memory of 772 2832 Sd8RQ8kX.exe sk0aN7Be.exe PID 772 wrote to memory of 4308 772 sk0aN7Be.exe Er3iM5Xh.exe PID 772 wrote to memory of 4308 772 sk0aN7Be.exe Er3iM5Xh.exe PID 772 wrote to memory of 4308 772 sk0aN7Be.exe Er3iM5Xh.exe PID 4308 wrote to memory of 548 4308 Er3iM5Xh.exe 1DW33ET8.exe PID 4308 wrote to memory of 548 4308 Er3iM5Xh.exe 1DW33ET8.exe PID 4308 wrote to memory of 548 4308 Er3iM5Xh.exe 1DW33ET8.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 548 wrote to memory of 4764 548 1DW33ET8.exe AppLaunch.exe PID 4308 wrote to memory of 4688 4308 Er3iM5Xh.exe 2NM322Sp.exe PID 4308 wrote to memory of 4688 4308 Er3iM5Xh.exe 2NM322Sp.exe PID 4308 wrote to memory of 4688 4308 Er3iM5Xh.exe 2NM322Sp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.df082341e3dfa9b4203cbcc9ce56d2d44ffdddb16d6fa744eb00cb67d3f6255a_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mt9qp2jg.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mt9qp2jg.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sd8RQ8kX.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sd8RQ8kX.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sk0aN7Be.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sk0aN7Be.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Er3iM5Xh.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Er3iM5Xh.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DW33ET8.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DW33ET8.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4764 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 5927⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2NM322Sp.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2NM322Sp.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4764 -ip 47641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 548 -ip 5481⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mt9qp2jg.exeFilesize
1.0MB
MD5a5f257f9d7db1fc79a6a65fe44146b62
SHA1ebe780b12264e843cf5e3ef6d5803fe5ce8d98d8
SHA256fc2ba2ae12d4ce92558fcabe0da44486931625a86a93e69ac9f63520b4412028
SHA5129785f1d7cd4a32088f410647efd5beb9fba7e33715d7001e52cb1b97f9a67ba59cb40d577dd43ff9d993f197068ce210be820eb95689a6322c54c5f2155aa009
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Mt9qp2jg.exeFilesize
1.0MB
MD5a5f257f9d7db1fc79a6a65fe44146b62
SHA1ebe780b12264e843cf5e3ef6d5803fe5ce8d98d8
SHA256fc2ba2ae12d4ce92558fcabe0da44486931625a86a93e69ac9f63520b4412028
SHA5129785f1d7cd4a32088f410647efd5beb9fba7e33715d7001e52cb1b97f9a67ba59cb40d577dd43ff9d993f197068ce210be820eb95689a6322c54c5f2155aa009
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sd8RQ8kX.exeFilesize
884KB
MD5a2acde444a301a3c84598b3fb8c6c4da
SHA1cadafcf1e96bac636ff9d5da45cc79b62864aa0f
SHA256eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b
SHA5129242447c31e6be528f2fa050f18aa607428e49d2b572cd797adbf43f38dced96c5ca16fd6b0581b17fc0a9406199e481faa99150cb9e646578672561bf00285f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Sd8RQ8kX.exeFilesize
884KB
MD5a2acde444a301a3c84598b3fb8c6c4da
SHA1cadafcf1e96bac636ff9d5da45cc79b62864aa0f
SHA256eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b
SHA5129242447c31e6be528f2fa050f18aa607428e49d2b572cd797adbf43f38dced96c5ca16fd6b0581b17fc0a9406199e481faa99150cb9e646578672561bf00285f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sk0aN7Be.exeFilesize
590KB
MD596ff283c100efaf89094a618113c3709
SHA1122c103d15556a781d48287472e4d4c3f6b3b598
SHA25643b3cda3f8e1cb5920a61bcaa710e0b426336360d614795ba231cb3c4c424868
SHA512e6179959cae3675f496bd887bc829a662f3834f5004e83f7fb65f768f155c8cb51fa5cea757ec666ed038c94f5fb87d630d43bc084f395c17962da59426712c9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sk0aN7Be.exeFilesize
590KB
MD596ff283c100efaf89094a618113c3709
SHA1122c103d15556a781d48287472e4d4c3f6b3b598
SHA25643b3cda3f8e1cb5920a61bcaa710e0b426336360d614795ba231cb3c4c424868
SHA512e6179959cae3675f496bd887bc829a662f3834f5004e83f7fb65f768f155c8cb51fa5cea757ec666ed038c94f5fb87d630d43bc084f395c17962da59426712c9
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Er3iM5Xh.exeFilesize
417KB
MD5f5fe73580e6061b453e5e52c1b4d1fe2
SHA1e29ff7c20633ba5b052d7bc24e3c056783af2f77
SHA256299663995567ce7e8d92c1a76f6910056efcce778fe83d664f85a3ca9b2e2059
SHA51240e96b896ae52e76ce5ed33cb5f68548b2bef2232721eecb2a2becb6f1523dd786778fd5bf454ef51727a755cb5959f69548139232f4cecb84941a3edb319977
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Er3iM5Xh.exeFilesize
417KB
MD5f5fe73580e6061b453e5e52c1b4d1fe2
SHA1e29ff7c20633ba5b052d7bc24e3c056783af2f77
SHA256299663995567ce7e8d92c1a76f6910056efcce778fe83d664f85a3ca9b2e2059
SHA51240e96b896ae52e76ce5ed33cb5f68548b2bef2232721eecb2a2becb6f1523dd786778fd5bf454ef51727a755cb5959f69548139232f4cecb84941a3edb319977
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DW33ET8.exeFilesize
378KB
MD5f0831f173733de08511f3a0739f278a6
SHA106dc809d653c5d2c97386084ae13b50a73eb5b60
SHA2568b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
SHA51219e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1DW33ET8.exeFilesize
378KB
MD5f0831f173733de08511f3a0739f278a6
SHA106dc809d653c5d2c97386084ae13b50a73eb5b60
SHA2568b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
SHA51219e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2NM322Sp.exeFilesize
231KB
MD59b9cbc983e6c062582f117df47db53c5
SHA1b8ff60c1b709e1f170db8ad7d7197ebadff4dbe6
SHA2566653c670b9c5df02e2ce27619d5881b7ccfa6e4b1927f0b8f062243857204e61
SHA51210532de95cbe17e2c8511f94479b725dab2a4806c380d3d3d856ae5033b109c61b64de7947205859a38dd09fcb47fbd378ff1e29a8237070a471735bf47a27d9
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2NM322Sp.exeFilesize
231KB
MD59b9cbc983e6c062582f117df47db53c5
SHA1b8ff60c1b709e1f170db8ad7d7197ebadff4dbe6
SHA2566653c670b9c5df02e2ce27619d5881b7ccfa6e4b1927f0b8f062243857204e61
SHA51210532de95cbe17e2c8511f94479b725dab2a4806c380d3d3d856ae5033b109c61b64de7947205859a38dd09fcb47fbd378ff1e29a8237070a471735bf47a27d9
-
memory/4688-46-0x0000000006F60000-0x0000000006FF2000-memory.dmpFilesize
584KB
-
memory/4688-43-0x00000000001A0000-0x00000000001DE000-memory.dmpFilesize
248KB
-
memory/4688-47-0x0000000007140000-0x0000000007150000-memory.dmpFilesize
64KB
-
memory/4688-55-0x0000000007140000-0x0000000007150000-memory.dmpFilesize
64KB
-
memory/4688-48-0x0000000007110000-0x000000000711A000-memory.dmpFilesize
40KB
-
memory/4688-44-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/4688-45-0x0000000007420000-0x00000000079C4000-memory.dmpFilesize
5.6MB
-
memory/4688-49-0x0000000007FF0000-0x0000000008608000-memory.dmpFilesize
6.1MB
-
memory/4688-54-0x00000000745F0000-0x0000000074DA0000-memory.dmpFilesize
7.7MB
-
memory/4688-53-0x0000000007AE0000-0x0000000007B2C000-memory.dmpFilesize
304KB
-
memory/4688-52-0x00000000073A0000-0x00000000073DC000-memory.dmpFilesize
240KB
-
memory/4688-50-0x00000000079D0000-0x0000000007ADA000-memory.dmpFilesize
1.0MB
-
memory/4688-51-0x0000000007340000-0x0000000007352000-memory.dmpFilesize
72KB
-
memory/4764-36-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4764-39-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4764-35-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4764-37-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB