Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2023, 19:58

General

  • Target

    file.exe

  • Size

    511KB

  • MD5

    d043a2dad04b5edda2db944f4ce621f7

  • SHA1

    2087ac8a835668bbbee974d591dc475e0449603d

  • SHA256

    e3346fe08c979602e5adbc8c80c6b5356ecee04d8331fb626f3f9cf36235ea97

  • SHA512

    808fedbad9a8c80c1f1c4b67980957d68bed56dbd1e972bfbac3b3eec059a1efb51af9185b49df57475d4f6a86668fba60bb28e327c73d1f91d43279e9965ac3

  • SSDEEP

    12288:HMrcy90XSe30Rn+o29koY3bicsLg4NkvSLAno/931j:Tyve30QD9koYricsLgekuwo/9R

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:60
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wM4Bt15.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wM4Bt15.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3144
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Wr483Tf.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Wr483Tf.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4312
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
            PID:2400
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2400 -s 540
              5⤵
              • Program crash
              PID:384
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4kx6gY7.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4kx6gY7.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2132
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
              PID:4944
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              4⤵
                PID:224
          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ie96xN.exe
            C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ie96xN.exe
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4720
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
              3⤵
                PID:2176
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2400 -ip 2400
            1⤵
              PID:1984

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ie96xN.exe

                    Filesize

                    73KB

                    MD5

                    bcbd3c60b750ac0cf9d69018df0e1771

                    SHA1

                    eb5cc68ccee25af2f360e6223f9ce9745c03f9e1

                    SHA256

                    29b78f3164bef67f5c7a2be8cfeb2c674ed387d8977536fa42de7ccd8149c4b9

                    SHA512

                    cb5feff6c3f392ce1aa6d03e406b980f7dd684042092bb51f5eef4f8fedf88c3ea8c467c877cb1fd20797b9dcd69df23717978fd1f63b947f42a0bc94a946361

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ie96xN.exe

                    Filesize

                    73KB

                    MD5

                    bcbd3c60b750ac0cf9d69018df0e1771

                    SHA1

                    eb5cc68ccee25af2f360e6223f9ce9745c03f9e1

                    SHA256

                    29b78f3164bef67f5c7a2be8cfeb2c674ed387d8977536fa42de7ccd8149c4b9

                    SHA512

                    cb5feff6c3f392ce1aa6d03e406b980f7dd684042092bb51f5eef4f8fedf88c3ea8c467c877cb1fd20797b9dcd69df23717978fd1f63b947f42a0bc94a946361

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wM4Bt15.exe

                    Filesize

                    388KB

                    MD5

                    730774dd62b888857f27803f348e69c5

                    SHA1

                    4489381fa8d64a437590e1bc8f4280ecf4829844

                    SHA256

                    5be2a8e89e19b28d5b535f39dc343814287eb7d85f48babd803b84af5675de4c

                    SHA512

                    e9d20a68944ae93626b1cb378dce3b9117b91dcac6fa38d84ef88939a0028a128635090a015caefc01a3fb19bed9569b44605c18d7e3caf10e47735b4f92d29b

                  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wM4Bt15.exe

                    Filesize

                    388KB

                    MD5

                    730774dd62b888857f27803f348e69c5

                    SHA1

                    4489381fa8d64a437590e1bc8f4280ecf4829844

                    SHA256

                    5be2a8e89e19b28d5b535f39dc343814287eb7d85f48babd803b84af5675de4c

                    SHA512

                    e9d20a68944ae93626b1cb378dce3b9117b91dcac6fa38d84ef88939a0028a128635090a015caefc01a3fb19bed9569b44605c18d7e3caf10e47735b4f92d29b

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Wr483Tf.exe

                    Filesize

                    300KB

                    MD5

                    6fc14a9c635856701da0ef1d98da8e36

                    SHA1

                    50f1989c23df0b078cb2c23bf639800297b71707

                    SHA256

                    750f7323e1dff4e8be12005177941334c86d48acbe7949cac30721f92b008da4

                    SHA512

                    10013810726c61e01ab3a971b15321a0b7b29380d754587f39f6840b3059293c4d3b18c07a790c302a086c18466b47ab90bcd74ec2a5c9a70364bf524bd28497

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Wr483Tf.exe

                    Filesize

                    300KB

                    MD5

                    6fc14a9c635856701da0ef1d98da8e36

                    SHA1

                    50f1989c23df0b078cb2c23bf639800297b71707

                    SHA256

                    750f7323e1dff4e8be12005177941334c86d48acbe7949cac30721f92b008da4

                    SHA512

                    10013810726c61e01ab3a971b15321a0b7b29380d754587f39f6840b3059293c4d3b18c07a790c302a086c18466b47ab90bcd74ec2a5c9a70364bf524bd28497

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4kx6gY7.exe

                    Filesize

                    339KB

                    MD5

                    e94d931a855236c7309d07d4b7d862ac

                    SHA1

                    43584d7ca607a4f80395883e4e51129524a49c4c

                    SHA256

                    829c19597ba300dc91ae26d18591ea6d388d97c62d1a8929f3c10ecdfa6bf0aa

                    SHA512

                    136a2be4bce598b7726dd5ec29b5aeb0a500ed466ac9bdc8e1a312de4dbb7beb7305999dd0b836afbd1219ded001444eea2b1c8e7f4f840aa3cf91439647a244

                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4kx6gY7.exe

                    Filesize

                    339KB

                    MD5

                    e94d931a855236c7309d07d4b7d862ac

                    SHA1

                    43584d7ca607a4f80395883e4e51129524a49c4c

                    SHA256

                    829c19597ba300dc91ae26d18591ea6d388d97c62d1a8929f3c10ecdfa6bf0aa

                    SHA512

                    136a2be4bce598b7726dd5ec29b5aeb0a500ed466ac9bdc8e1a312de4dbb7beb7305999dd0b836afbd1219ded001444eea2b1c8e7f4f840aa3cf91439647a244

                  • C:\Users\Admin\AppData\Local\Temp\is64.bat

                    Filesize

                    181B

                    MD5

                    225edee1d46e0a80610db26b275d72fb

                    SHA1

                    ce206abf11aaf19278b72f5021cc64b1b427b7e8

                    SHA256

                    e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

                    SHA512

                    4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

                  • C:\Users\Admin\AppData\Local\Temp\is64.txt

                    Filesize

                    3B

                    MD5

                    a5ea0ad9260b1550a14cc58d2c39b03d

                    SHA1

                    f0aedf295071ed34ab8c6a7692223d22b6a19841

                    SHA256

                    f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

                    SHA512

                    7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

                  • memory/224-34-0x0000000007C50000-0x0000000007C5A000-memory.dmp

                    Filesize

                    40KB

                  • memory/224-22-0x0000000000400000-0x000000000043C000-memory.dmp

                    Filesize

                    240KB

                  • memory/224-45-0x0000000007C00000-0x0000000007C10000-memory.dmp

                    Filesize

                    64KB

                  • memory/224-28-0x0000000073FC0000-0x0000000074770000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/224-29-0x0000000007F40000-0x00000000084E4000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/224-31-0x0000000007A50000-0x0000000007AE2000-memory.dmp

                    Filesize

                    584KB

                  • memory/224-33-0x0000000007C00000-0x0000000007C10000-memory.dmp

                    Filesize

                    64KB

                  • memory/224-44-0x0000000073FC0000-0x0000000074770000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/224-43-0x0000000007DF0000-0x0000000007E3C000-memory.dmp

                    Filesize

                    304KB

                  • memory/224-39-0x0000000008B10000-0x0000000009128000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/224-42-0x0000000007D80000-0x0000000007DBC000-memory.dmp

                    Filesize

                    240KB

                  • memory/224-40-0x00000000084F0000-0x00000000085FA000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/224-41-0x0000000007D20000-0x0000000007D32000-memory.dmp

                    Filesize

                    72KB

                  • memory/2400-14-0x0000000000400000-0x0000000000433000-memory.dmp

                    Filesize

                    204KB

                  • memory/2400-16-0x0000000000400000-0x0000000000433000-memory.dmp

                    Filesize

                    204KB

                  • memory/2400-18-0x0000000000400000-0x0000000000433000-memory.dmp

                    Filesize

                    204KB

                  • memory/2400-15-0x0000000000400000-0x0000000000433000-memory.dmp

                    Filesize

                    204KB