Analysis Overview
SHA256
dbdbf2d214befe3e34f94bd671f8c084af36d3bffdde93f942ee724311a24ecc
Threat Level: Known bad
The file NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe was found to be: Known bad.
Malicious Activity Summary
Modifies Windows Defender Real-time Protection settings
RedLine
Mystic
Healer
Detect Mystic stealer payload
Detects Healer an antivirus disabler dropper
Windows security modification
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Unsigned PE
Suspicious use of WriteProcessMemory
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-10-21 18:27
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-10-21 18:27
Reported
2023-10-21 18:29
Platform
win7-20230831-en
Max time kernel
128s
Max time network
140s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Mystic
RedLine
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
Network
| Country | Destination | Domain | Proto |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp |
Files
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
| MD5 | 415555ba47944afaf563f9718977c7f8 |
| SHA1 | a05abed9f844bf2bcb069af169bdddec25a9d324 |
| SHA256 | 58d4a4e267b5caa280c970a01c5c6a4b801e141599f479244c85f15a8436bb82 |
| SHA512 | 69719c760cefd2f0659a40f1d43a7440c999bb23fd636dd8c332abd739a1cd465624a4aa950bdc60177bd464d64dc07716ac73b6e6f2528eaacd852e1cbc79cf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
| MD5 | 415555ba47944afaf563f9718977c7f8 |
| SHA1 | a05abed9f844bf2bcb069af169bdddec25a9d324 |
| SHA256 | 58d4a4e267b5caa280c970a01c5c6a4b801e141599f479244c85f15a8436bb82 |
| SHA512 | 69719c760cefd2f0659a40f1d43a7440c999bb23fd636dd8c332abd739a1cd465624a4aa950bdc60177bd464d64dc07716ac73b6e6f2528eaacd852e1cbc79cf |
\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
| MD5 | 415555ba47944afaf563f9718977c7f8 |
| SHA1 | a05abed9f844bf2bcb069af169bdddec25a9d324 |
| SHA256 | 58d4a4e267b5caa280c970a01c5c6a4b801e141599f479244c85f15a8436bb82 |
| SHA512 | 69719c760cefd2f0659a40f1d43a7440c999bb23fd636dd8c332abd739a1cd465624a4aa950bdc60177bd464d64dc07716ac73b6e6f2528eaacd852e1cbc79cf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
| MD5 | 415555ba47944afaf563f9718977c7f8 |
| SHA1 | a05abed9f844bf2bcb069af169bdddec25a9d324 |
| SHA256 | 58d4a4e267b5caa280c970a01c5c6a4b801e141599f479244c85f15a8436bb82 |
| SHA512 | 69719c760cefd2f0659a40f1d43a7440c999bb23fd636dd8c332abd739a1cd465624a4aa950bdc60177bd464d64dc07716ac73b6e6f2528eaacd852e1cbc79cf |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
| MD5 | 12cb47ab7180c56f1b4189139e71b6ae |
| SHA1 | dd2dcbbe6a2f5c5f460bc571e17c796e44740b22 |
| SHA256 | 139727d04692ae3e774bd83716c13a2a692600a9f72931a4a54fe11c49486dd1 |
| SHA512 | bfc42de1cbee3caa06f02cb4b767539f32f1395ecbe77ab38e2c8dfd110bcb2cfe1e6033881b3c23d6caecfe170bd47c7023d456ee64c859fd9f43874425f506 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
| MD5 | 12cb47ab7180c56f1b4189139e71b6ae |
| SHA1 | dd2dcbbe6a2f5c5f460bc571e17c796e44740b22 |
| SHA256 | 139727d04692ae3e774bd83716c13a2a692600a9f72931a4a54fe11c49486dd1 |
| SHA512 | bfc42de1cbee3caa06f02cb4b767539f32f1395ecbe77ab38e2c8dfd110bcb2cfe1e6033881b3c23d6caecfe170bd47c7023d456ee64c859fd9f43874425f506 |
\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
| MD5 | 12cb47ab7180c56f1b4189139e71b6ae |
| SHA1 | dd2dcbbe6a2f5c5f460bc571e17c796e44740b22 |
| SHA256 | 139727d04692ae3e774bd83716c13a2a692600a9f72931a4a54fe11c49486dd1 |
| SHA512 | bfc42de1cbee3caa06f02cb4b767539f32f1395ecbe77ab38e2c8dfd110bcb2cfe1e6033881b3c23d6caecfe170bd47c7023d456ee64c859fd9f43874425f506 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
| MD5 | 12cb47ab7180c56f1b4189139e71b6ae |
| SHA1 | dd2dcbbe6a2f5c5f460bc571e17c796e44740b22 |
| SHA256 | 139727d04692ae3e774bd83716c13a2a692600a9f72931a4a54fe11c49486dd1 |
| SHA512 | bfc42de1cbee3caa06f02cb4b767539f32f1395ecbe77ab38e2c8dfd110bcb2cfe1e6033881b3c23d6caecfe170bd47c7023d456ee64c859fd9f43874425f506 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
| MD5 | 73a381513d9be2fce53f59c72894a463 |
| SHA1 | b3eac8b29e341f607fda66414d27c312a4a20f85 |
| SHA256 | b4a0d06b15d5133ac593febfde376d5fc63269e1ddbe06f770b6289650770b3a |
| SHA512 | ee687da206136b7f72fe2837247780168de91b1a0a734727c10aff5b66bdc9c3704c38f5331943e988985974ffb112cd4ed6140975f2d123b2a8fb8dfd4fd4d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
| MD5 | 73a381513d9be2fce53f59c72894a463 |
| SHA1 | b3eac8b29e341f607fda66414d27c312a4a20f85 |
| SHA256 | b4a0d06b15d5133ac593febfde376d5fc63269e1ddbe06f770b6289650770b3a |
| SHA512 | ee687da206136b7f72fe2837247780168de91b1a0a734727c10aff5b66bdc9c3704c38f5331943e988985974ffb112cd4ed6140975f2d123b2a8fb8dfd4fd4d8 |
\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
| MD5 | 73a381513d9be2fce53f59c72894a463 |
| SHA1 | b3eac8b29e341f607fda66414d27c312a4a20f85 |
| SHA256 | b4a0d06b15d5133ac593febfde376d5fc63269e1ddbe06f770b6289650770b3a |
| SHA512 | ee687da206136b7f72fe2837247780168de91b1a0a734727c10aff5b66bdc9c3704c38f5331943e988985974ffb112cd4ed6140975f2d123b2a8fb8dfd4fd4d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
| MD5 | 73a381513d9be2fce53f59c72894a463 |
| SHA1 | b3eac8b29e341f607fda66414d27c312a4a20f85 |
| SHA256 | b4a0d06b15d5133ac593febfde376d5fc63269e1ddbe06f770b6289650770b3a |
| SHA512 | ee687da206136b7f72fe2837247780168de91b1a0a734727c10aff5b66bdc9c3704c38f5331943e988985974ffb112cd4ed6140975f2d123b2a8fb8dfd4fd4d8 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
| MD5 | 81feecb848547342f5276e6ce9097966 |
| SHA1 | e5b8db9aa2d405bb8cd1a59948f482b2d4c6be70 |
| SHA256 | 88285d094d03bacaa3fe9684832f4de049cc6607dbef8db6efda0d66c7325c10 |
| SHA512 | 9c2bbe33a7f761b721944979a68c20c8febc91559a7ef99756df23c071f73b7476076950dfd8ab6826bf04fce44e29699f20fa3105ec32be33bf95798deca70e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
| MD5 | 81feecb848547342f5276e6ce9097966 |
| SHA1 | e5b8db9aa2d405bb8cd1a59948f482b2d4c6be70 |
| SHA256 | 88285d094d03bacaa3fe9684832f4de049cc6607dbef8db6efda0d66c7325c10 |
| SHA512 | 9c2bbe33a7f761b721944979a68c20c8febc91559a7ef99756df23c071f73b7476076950dfd8ab6826bf04fce44e29699f20fa3105ec32be33bf95798deca70e |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
| MD5 | 81feecb848547342f5276e6ce9097966 |
| SHA1 | e5b8db9aa2d405bb8cd1a59948f482b2d4c6be70 |
| SHA256 | 88285d094d03bacaa3fe9684832f4de049cc6607dbef8db6efda0d66c7325c10 |
| SHA512 | 9c2bbe33a7f761b721944979a68c20c8febc91559a7ef99756df23c071f73b7476076950dfd8ab6826bf04fce44e29699f20fa3105ec32be33bf95798deca70e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
| MD5 | 81feecb848547342f5276e6ce9097966 |
| SHA1 | e5b8db9aa2d405bb8cd1a59948f482b2d4c6be70 |
| SHA256 | 88285d094d03bacaa3fe9684832f4de049cc6607dbef8db6efda0d66c7325c10 |
| SHA512 | 9c2bbe33a7f761b721944979a68c20c8febc91559a7ef99756df23c071f73b7476076950dfd8ab6826bf04fce44e29699f20fa3105ec32be33bf95798deca70e |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
| MD5 | 83361b313229ca02e56e354849c3dd6d |
| SHA1 | f7deacf3acf99bddf7093174c4879cc8a6a7a557 |
| SHA256 | c2b87ae8a030650f91d000433ea144aa022fe4782cfba2cf8061dd31749a797a |
| SHA512 | ecc4b4dda02679e0908fc3420ca776479bc688220fc5fa5c20a1d88670d6adc3c8c7335c132059928ab90fdb22813fea694ab42d9796d7e54441d1faa85374ee |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
| MD5 | 83361b313229ca02e56e354849c3dd6d |
| SHA1 | f7deacf3acf99bddf7093174c4879cc8a6a7a557 |
| SHA256 | c2b87ae8a030650f91d000433ea144aa022fe4782cfba2cf8061dd31749a797a |
| SHA512 | ecc4b4dda02679e0908fc3420ca776479bc688220fc5fa5c20a1d88670d6adc3c8c7335c132059928ab90fdb22813fea694ab42d9796d7e54441d1faa85374ee |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
| MD5 | 83361b313229ca02e56e354849c3dd6d |
| SHA1 | f7deacf3acf99bddf7093174c4879cc8a6a7a557 |
| SHA256 | c2b87ae8a030650f91d000433ea144aa022fe4782cfba2cf8061dd31749a797a |
| SHA512 | ecc4b4dda02679e0908fc3420ca776479bc688220fc5fa5c20a1d88670d6adc3c8c7335c132059928ab90fdb22813fea694ab42d9796d7e54441d1faa85374ee |
memory/2684-49-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp
memory/2684-48-0x0000000001060000-0x000000000106A000-memory.dmp
memory/2684-50-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp
memory/2684-51-0x000007FEF5300000-0x000007FEF5CEC000-memory.dmp
\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
| MD5 | 2a7607153562d2d5d1df279631aba1a7 |
| SHA1 | 914a04e4cd0992bd88f8b533737e1ac96ba9f68f |
| SHA256 | 28652bf8e6fbac45ae8d1aa57f25ca24dec945acb6abc62a51833d75750ea6a0 |
| SHA512 | 63de2e129e4b7b7b29cb7ea73e9c2fee97e9403832268ae1fe920b18d0fad7957ca3a325ede20f8188b0c49e97db1a8b52a668bc0ac405604bfbbfe0054389d2 |
\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
| MD5 | 2a7607153562d2d5d1df279631aba1a7 |
| SHA1 | 914a04e4cd0992bd88f8b533737e1ac96ba9f68f |
| SHA256 | 28652bf8e6fbac45ae8d1aa57f25ca24dec945acb6abc62a51833d75750ea6a0 |
| SHA512 | 63de2e129e4b7b7b29cb7ea73e9c2fee97e9403832268ae1fe920b18d0fad7957ca3a325ede20f8188b0c49e97db1a8b52a668bc0ac405604bfbbfe0054389d2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
| MD5 | 2a7607153562d2d5d1df279631aba1a7 |
| SHA1 | 914a04e4cd0992bd88f8b533737e1ac96ba9f68f |
| SHA256 | 28652bf8e6fbac45ae8d1aa57f25ca24dec945acb6abc62a51833d75750ea6a0 |
| SHA512 | 63de2e129e4b7b7b29cb7ea73e9c2fee97e9403832268ae1fe920b18d0fad7957ca3a325ede20f8188b0c49e97db1a8b52a668bc0ac405604bfbbfe0054389d2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
| MD5 | 2a7607153562d2d5d1df279631aba1a7 |
| SHA1 | 914a04e4cd0992bd88f8b533737e1ac96ba9f68f |
| SHA256 | 28652bf8e6fbac45ae8d1aa57f25ca24dec945acb6abc62a51833d75750ea6a0 |
| SHA512 | 63de2e129e4b7b7b29cb7ea73e9c2fee97e9403832268ae1fe920b18d0fad7957ca3a325ede20f8188b0c49e97db1a8b52a668bc0ac405604bfbbfe0054389d2 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
| MD5 | 43265bcc005d9a1503337598df008d86 |
| SHA1 | 4b486f9df4dc55196d239233f5b08730d707e2c2 |
| SHA256 | 314d3100f41aae15aef90f5e94d62c4349fc0cf8004170a2f233a988d10eca00 |
| SHA512 | dd64761d11aaf380cccedff1d14f6e36284450d4edf8777940c24d3f4eb7f1ba1369dbc903247f7bf765d55ee596a993e8512aec763fce3da71e4d4365752214 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
| MD5 | 43265bcc005d9a1503337598df008d86 |
| SHA1 | 4b486f9df4dc55196d239233f5b08730d707e2c2 |
| SHA256 | 314d3100f41aae15aef90f5e94d62c4349fc0cf8004170a2f233a988d10eca00 |
| SHA512 | dd64761d11aaf380cccedff1d14f6e36284450d4edf8777940c24d3f4eb7f1ba1369dbc903247f7bf765d55ee596a993e8512aec763fce3da71e4d4365752214 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
| MD5 | 43265bcc005d9a1503337598df008d86 |
| SHA1 | 4b486f9df4dc55196d239233f5b08730d707e2c2 |
| SHA256 | 314d3100f41aae15aef90f5e94d62c4349fc0cf8004170a2f233a988d10eca00 |
| SHA512 | dd64761d11aaf380cccedff1d14f6e36284450d4edf8777940c24d3f4eb7f1ba1369dbc903247f7bf765d55ee596a993e8512aec763fce3da71e4d4365752214 |
\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
| MD5 | 43265bcc005d9a1503337598df008d86 |
| SHA1 | 4b486f9df4dc55196d239233f5b08730d707e2c2 |
| SHA256 | 314d3100f41aae15aef90f5e94d62c4349fc0cf8004170a2f233a988d10eca00 |
| SHA512 | dd64761d11aaf380cccedff1d14f6e36284450d4edf8777940c24d3f4eb7f1ba1369dbc903247f7bf765d55ee596a993e8512aec763fce3da71e4d4365752214 |
memory/2732-64-0x0000000001020000-0x0000000001050000-memory.dmp
memory/2732-65-0x0000000000370000-0x0000000000376000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2023-10-21 18:27
Reported
2023-10-21 18:30
Platform
win10v2004-20231020-en
Max time kernel
156s
Max time network
170s
Command Line
Signatures
Detect Mystic stealer payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Detects Healer an antivirus disabler dropper
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Healer
Modifies Windows Defender Real-time Protection settings
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Mystic
RedLine
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe | N/A |
Windows security modification
| Description | Indicator | Process | Target |
| Set value (int) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" | C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.e2537e7eee02e7684bee997333ab9d40_JC.exe"
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 73.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.228.82.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 254.209.247.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 43.58.199.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 29.81.57.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.154.82.20.in-addr.arpa | udp |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp | |
| US | 8.8.8.8:53 | 1.202.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 48.229.111.52.in-addr.arpa | udp |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp | |
| FI | 77.91.124.73:19071 | tcp | |
| US | 8.8.8.8:53 | 152.141.79.40.in-addr.arpa | udp |
| FI | 77.91.124.73:19071 | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
| MD5 | 415555ba47944afaf563f9718977c7f8 |
| SHA1 | a05abed9f844bf2bcb069af169bdddec25a9d324 |
| SHA256 | 58d4a4e267b5caa280c970a01c5c6a4b801e141599f479244c85f15a8436bb82 |
| SHA512 | 69719c760cefd2f0659a40f1d43a7440c999bb23fd636dd8c332abd739a1cd465624a4aa950bdc60177bd464d64dc07716ac73b6e6f2528eaacd852e1cbc79cf |
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v8660466.exe
| MD5 | 415555ba47944afaf563f9718977c7f8 |
| SHA1 | a05abed9f844bf2bcb069af169bdddec25a9d324 |
| SHA256 | 58d4a4e267b5caa280c970a01c5c6a4b801e141599f479244c85f15a8436bb82 |
| SHA512 | 69719c760cefd2f0659a40f1d43a7440c999bb23fd636dd8c332abd739a1cd465624a4aa950bdc60177bd464d64dc07716ac73b6e6f2528eaacd852e1cbc79cf |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
| MD5 | 12cb47ab7180c56f1b4189139e71b6ae |
| SHA1 | dd2dcbbe6a2f5c5f460bc571e17c796e44740b22 |
| SHA256 | 139727d04692ae3e774bd83716c13a2a692600a9f72931a4a54fe11c49486dd1 |
| SHA512 | bfc42de1cbee3caa06f02cb4b767539f32f1395ecbe77ab38e2c8dfd110bcb2cfe1e6033881b3c23d6caecfe170bd47c7023d456ee64c859fd9f43874425f506 |
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v1467285.exe
| MD5 | 12cb47ab7180c56f1b4189139e71b6ae |
| SHA1 | dd2dcbbe6a2f5c5f460bc571e17c796e44740b22 |
| SHA256 | 139727d04692ae3e774bd83716c13a2a692600a9f72931a4a54fe11c49486dd1 |
| SHA512 | bfc42de1cbee3caa06f02cb4b767539f32f1395ecbe77ab38e2c8dfd110bcb2cfe1e6033881b3c23d6caecfe170bd47c7023d456ee64c859fd9f43874425f506 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
| MD5 | 73a381513d9be2fce53f59c72894a463 |
| SHA1 | b3eac8b29e341f607fda66414d27c312a4a20f85 |
| SHA256 | b4a0d06b15d5133ac593febfde376d5fc63269e1ddbe06f770b6289650770b3a |
| SHA512 | ee687da206136b7f72fe2837247780168de91b1a0a734727c10aff5b66bdc9c3704c38f5331943e988985974ffb112cd4ed6140975f2d123b2a8fb8dfd4fd4d8 |
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v5639748.exe
| MD5 | 73a381513d9be2fce53f59c72894a463 |
| SHA1 | b3eac8b29e341f607fda66414d27c312a4a20f85 |
| SHA256 | b4a0d06b15d5133ac593febfde376d5fc63269e1ddbe06f770b6289650770b3a |
| SHA512 | ee687da206136b7f72fe2837247780168de91b1a0a734727c10aff5b66bdc9c3704c38f5331943e988985974ffb112cd4ed6140975f2d123b2a8fb8dfd4fd4d8 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
| MD5 | 81feecb848547342f5276e6ce9097966 |
| SHA1 | e5b8db9aa2d405bb8cd1a59948f482b2d4c6be70 |
| SHA256 | 88285d094d03bacaa3fe9684832f4de049cc6607dbef8db6efda0d66c7325c10 |
| SHA512 | 9c2bbe33a7f761b721944979a68c20c8febc91559a7ef99756df23c071f73b7476076950dfd8ab6826bf04fce44e29699f20fa3105ec32be33bf95798deca70e |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5740047.exe
| MD5 | 81feecb848547342f5276e6ce9097966 |
| SHA1 | e5b8db9aa2d405bb8cd1a59948f482b2d4c6be70 |
| SHA256 | 88285d094d03bacaa3fe9684832f4de049cc6607dbef8db6efda0d66c7325c10 |
| SHA512 | 9c2bbe33a7f761b721944979a68c20c8febc91559a7ef99756df23c071f73b7476076950dfd8ab6826bf04fce44e29699f20fa3105ec32be33bf95798deca70e |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
| MD5 | 83361b313229ca02e56e354849c3dd6d |
| SHA1 | f7deacf3acf99bddf7093174c4879cc8a6a7a557 |
| SHA256 | c2b87ae8a030650f91d000433ea144aa022fe4782cfba2cf8061dd31749a797a |
| SHA512 | ecc4b4dda02679e0908fc3420ca776479bc688220fc5fa5c20a1d88670d6adc3c8c7335c132059928ab90fdb22813fea694ab42d9796d7e54441d1faa85374ee |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\a0168194.exe
| MD5 | 83361b313229ca02e56e354849c3dd6d |
| SHA1 | f7deacf3acf99bddf7093174c4879cc8a6a7a557 |
| SHA256 | c2b87ae8a030650f91d000433ea144aa022fe4782cfba2cf8061dd31749a797a |
| SHA512 | ecc4b4dda02679e0908fc3420ca776479bc688220fc5fa5c20a1d88670d6adc3c8c7335c132059928ab90fdb22813fea694ab42d9796d7e54441d1faa85374ee |
memory/1960-35-0x0000000000480000-0x000000000048A000-memory.dmp
memory/1960-36-0x00007FFBBCB80000-0x00007FFBBD641000-memory.dmp
memory/1960-37-0x00007FFBBCB80000-0x00007FFBBD641000-memory.dmp
memory/1960-39-0x00007FFBBCB80000-0x00007FFBBD641000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
| MD5 | 2a7607153562d2d5d1df279631aba1a7 |
| SHA1 | 914a04e4cd0992bd88f8b533737e1ac96ba9f68f |
| SHA256 | 28652bf8e6fbac45ae8d1aa57f25ca24dec945acb6abc62a51833d75750ea6a0 |
| SHA512 | 63de2e129e4b7b7b29cb7ea73e9c2fee97e9403832268ae1fe920b18d0fad7957ca3a325ede20f8188b0c49e97db1a8b52a668bc0ac405604bfbbfe0054389d2 |
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\b3784967.exe
| MD5 | 2a7607153562d2d5d1df279631aba1a7 |
| SHA1 | 914a04e4cd0992bd88f8b533737e1ac96ba9f68f |
| SHA256 | 28652bf8e6fbac45ae8d1aa57f25ca24dec945acb6abc62a51833d75750ea6a0 |
| SHA512 | 63de2e129e4b7b7b29cb7ea73e9c2fee97e9403832268ae1fe920b18d0fad7957ca3a325ede20f8188b0c49e97db1a8b52a668bc0ac405604bfbbfe0054389d2 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
| MD5 | 43265bcc005d9a1503337598df008d86 |
| SHA1 | 4b486f9df4dc55196d239233f5b08730d707e2c2 |
| SHA256 | 314d3100f41aae15aef90f5e94d62c4349fc0cf8004170a2f233a988d10eca00 |
| SHA512 | dd64761d11aaf380cccedff1d14f6e36284450d4edf8777940c24d3f4eb7f1ba1369dbc903247f7bf765d55ee596a993e8512aec763fce3da71e4d4365752214 |
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\c5754882.exe
| MD5 | 43265bcc005d9a1503337598df008d86 |
| SHA1 | 4b486f9df4dc55196d239233f5b08730d707e2c2 |
| SHA256 | 314d3100f41aae15aef90f5e94d62c4349fc0cf8004170a2f233a988d10eca00 |
| SHA512 | dd64761d11aaf380cccedff1d14f6e36284450d4edf8777940c24d3f4eb7f1ba1369dbc903247f7bf765d55ee596a993e8512aec763fce3da71e4d4365752214 |
memory/1628-46-0x0000000000DF0000-0x0000000000E20000-memory.dmp
memory/1628-47-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/1628-48-0x0000000005590000-0x0000000005596000-memory.dmp
memory/1628-49-0x000000000B0E0000-0x000000000B6F8000-memory.dmp
memory/1628-50-0x000000000AC60000-0x000000000AD6A000-memory.dmp
memory/1628-52-0x000000000ABA0000-0x000000000ABB2000-memory.dmp
memory/1628-51-0x00000000055B0000-0x00000000055C0000-memory.dmp
memory/1628-53-0x000000000AC00000-0x000000000AC3C000-memory.dmp
memory/1628-54-0x000000000AD70000-0x000000000ADBC000-memory.dmp
memory/1628-55-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/1628-56-0x00000000055B0000-0x00000000055C0000-memory.dmp