Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-11-2023 10:05

General

  • Target

    NEAS.8e5d766de64770d88cdb55ac884a25e49726b72c0bbe7912cb52c8f578fc8941.exe

  • Size

    511KB

  • MD5

    f5a714ad642a6d713d7238740abb022a

  • SHA1

    6d352e474c006ef0bfca330921515be1d4c31664

  • SHA256

    8e5d766de64770d88cdb55ac884a25e49726b72c0bbe7912cb52c8f578fc8941

  • SHA512

    2f785c2f0bed168e167a32e0bec02aefe7fdabf2f3b0599c6bea197a5f4994b8e8ebbfa4f2f262bef54213130164974f5dbfaa36655cc7238776d4e7a22024de

  • SSDEEP

    12288:tMr7y902bBA+St/vIgwsrMkLCY8TUs2EuX+4+wSRQFw/xHj:CyBTSlA0rlCYSz2EuuUS+q/Zj

Malware Config

Extracted

Family

redline

Botnet

taiga

C2

5.42.92.51:19057

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.8e5d766de64770d88cdb55ac884a25e49726b72c0bbe7912cb52c8f578fc8941.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.8e5d766de64770d88cdb55ac884a25e49726b72c0bbe7912cb52c8f578fc8941.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RD9kV38.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RD9kV38.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:228
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3XJ945ru.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3XJ945ru.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3484
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
            PID:320
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
              PID:1004
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 540
                5⤵
                • Program crash
                PID:1140
          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4jm2Sl1.exe
            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4jm2Sl1.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1484
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              4⤵
                PID:2444
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                4⤵
                  PID:4980
            • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ab83Pz.exe
              C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ab83Pz.exe
              2⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3772
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
                3⤵
                  PID:2400
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1004 -ip 1004
              1⤵
                PID:864

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ab83Pz.exe

                Filesize

                73KB

                MD5

                a61ca01064586ed8060e32190d2ee30c

                SHA1

                9cc56ed5345c7cc577bd366f8c1b755642c7eecc

                SHA256

                906712803c648b27fbe4de937c3ac02f88304a07ee272a7e6713f95d4f5058d0

                SHA512

                ae6d570f4dda1565f1debdd07da201ce1509e9fef1505fd0518910ebc74a862cc26f599cec07f3ee7e47366aa9a763c8ef2b01894d0645dc2bda03998059bf63

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5Ab83Pz.exe

                Filesize

                73KB

                MD5

                a61ca01064586ed8060e32190d2ee30c

                SHA1

                9cc56ed5345c7cc577bd366f8c1b755642c7eecc

                SHA256

                906712803c648b27fbe4de937c3ac02f88304a07ee272a7e6713f95d4f5058d0

                SHA512

                ae6d570f4dda1565f1debdd07da201ce1509e9fef1505fd0518910ebc74a862cc26f599cec07f3ee7e47366aa9a763c8ef2b01894d0645dc2bda03998059bf63

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RD9kV38.exe

                Filesize

                389KB

                MD5

                9fd599dab087e8b324cd7a6831eaf281

                SHA1

                73bd07b12033306de581530196eb18513034f37b

                SHA256

                f8e024b87d89d1aa2bdc6282db5aaee594e04564d93b0b4b57ab11bef5f05783

                SHA512

                81efb50ac818444e84568cb753cf17c091c35feadaf4ccd0144b3228bef5635a19c60aef37eb1381d72c11df5ce6b96e05cbd59692fdda1a546bbf5f67f10709

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RD9kV38.exe

                Filesize

                389KB

                MD5

                9fd599dab087e8b324cd7a6831eaf281

                SHA1

                73bd07b12033306de581530196eb18513034f37b

                SHA256

                f8e024b87d89d1aa2bdc6282db5aaee594e04564d93b0b4b57ab11bef5f05783

                SHA512

                81efb50ac818444e84568cb753cf17c091c35feadaf4ccd0144b3228bef5635a19c60aef37eb1381d72c11df5ce6b96e05cbd59692fdda1a546bbf5f67f10709

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3XJ945ru.exe

                Filesize

                300KB

                MD5

                784667bb96ccb30c4cf44f2c5f493769

                SHA1

                28185165ab4dbbb4a139ae1af0bb6934ebe05c04

                SHA256

                1025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9

                SHA512

                62c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3XJ945ru.exe

                Filesize

                300KB

                MD5

                784667bb96ccb30c4cf44f2c5f493769

                SHA1

                28185165ab4dbbb4a139ae1af0bb6934ebe05c04

                SHA256

                1025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9

                SHA512

                62c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4jm2Sl1.exe

                Filesize

                339KB

                MD5

                14d9834611ad581afcfea061652ff6cb

                SHA1

                802f964d0be7858eb2f1e7c6fcda03501fd1b71c

                SHA256

                e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60

                SHA512

                cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4jm2Sl1.exe

                Filesize

                339KB

                MD5

                14d9834611ad581afcfea061652ff6cb

                SHA1

                802f964d0be7858eb2f1e7c6fcda03501fd1b71c

                SHA256

                e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60

                SHA512

                cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5

              • C:\Users\Admin\AppData\Local\Temp\is64.bat

                Filesize

                181B

                MD5

                225edee1d46e0a80610db26b275d72fb

                SHA1

                ce206abf11aaf19278b72f5021cc64b1b427b7e8

                SHA256

                e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

                SHA512

                4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

              • C:\Users\Admin\AppData\Local\Temp\is64.txt

                Filesize

                3B

                MD5

                a5ea0ad9260b1550a14cc58d2c39b03d

                SHA1

                f0aedf295071ed34ab8c6a7692223d22b6a19841

                SHA256

                f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

                SHA512

                7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

              • memory/1004-15-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/1004-18-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/1004-16-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/1004-14-0x0000000000400000-0x0000000000433000-memory.dmp

                Filesize

                204KB

              • memory/4980-29-0x0000000007CC0000-0x0000000008264000-memory.dmp

                Filesize

                5.6MB

              • memory/4980-30-0x00000000077B0000-0x0000000007842000-memory.dmp

                Filesize

                584KB

              • memory/4980-33-0x0000000007A30000-0x0000000007A40000-memory.dmp

                Filesize

                64KB

              • memory/4980-22-0x0000000000400000-0x000000000043C000-memory.dmp

                Filesize

                240KB

              • memory/4980-28-0x0000000073940000-0x00000000740F0000-memory.dmp

                Filesize

                7.7MB

              • memory/4980-38-0x0000000007780000-0x000000000778A000-memory.dmp

                Filesize

                40KB

              • memory/4980-39-0x0000000008890000-0x0000000008EA8000-memory.dmp

                Filesize

                6.1MB

              • memory/4980-40-0x0000000007B50000-0x0000000007C5A000-memory.dmp

                Filesize

                1.0MB

              • memory/4980-41-0x00000000079F0000-0x0000000007A02000-memory.dmp

                Filesize

                72KB

              • memory/4980-42-0x0000000007A80000-0x0000000007ABC000-memory.dmp

                Filesize

                240KB

              • memory/4980-43-0x0000000007AC0000-0x0000000007B0C000-memory.dmp

                Filesize

                304KB

              • memory/4980-44-0x0000000073940000-0x00000000740F0000-memory.dmp

                Filesize

                7.7MB

              • memory/4980-45-0x0000000007A30000-0x0000000007A40000-memory.dmp

                Filesize

                64KB