Analysis

  • max time kernel
    145s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2024, 10:08

General

  • Target

    168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe

  • Size

    1.5MB

  • MD5

    827616c5464fcc383ad3ef0ea187e34a

  • SHA1

    ecded2c0f2ac47d156bebc9c7ce360b1ef471ff1

  • SHA256

    168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6

  • SHA512

    985d13422ec4efd209147a1009d42be01e74e785a8256f0c07a9991fa30710897491a0fc9beb8d29b42a279a5639a87650dc4a6028ef1e871a5de5ebc6e1d67a

  • SSDEEP

    24576:5yf7bF2EiBtiau3+RH2VxEm0Lm23oliLiR9+FDTkx1lveYOrMgBA7cFmhIrUeTr:sfXFfiKORH2XEm0Ld4llR4hgxHveJr/O

Malware Config

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Signatures

  • Detect Mystic stealer payload 3 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe
    "C:\Users\Admin\AppData\Local\Temp\168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wq5qV4tA.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wq5qV4tA.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:4660
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lP8WU7wL.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lP8WU7wL.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1616
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uQ8Vn7Ot.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uQ8Vn7Ot.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:1744
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ml4Mq9ov.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ml4Mq9ov.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1048
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yi85Az5.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yi85Az5.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1580
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                  PID:3576
              • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2oe768ZT.exe
                C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2oe768ZT.exe
                6⤵
                • Executes dropped EXE
                PID:232
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4468

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wq5qV4tA.exe

        Filesize

        1.3MB

        MD5

        5f5f1612ea1e4ba87701c432ea80c1b1

        SHA1

        207c9c55d5a5b58190864ec5980ac8ff8d99ac83

        SHA256

        a807a9f78807fb7b008068acd1bde0f1dc2fc5e627b9cbc9f6f2bc4cec59167b

        SHA512

        5143bbeeb4fa3f10499a1e1a7dc0b3cc662d2780bcf1f4a95f9cf6f682ae759945274f10a3d4c8a51907f9db7753e1e4dc1fae6e2c98f72e14c4ee6c91cad43d

      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lP8WU7wL.exe

        Filesize

        1.2MB

        MD5

        d6ea073af1e8f79264a214fdc34ed195

        SHA1

        925ded893445fe4e068739cb9af00f0f2f4e6ea0

        SHA256

        a8ac35d6a8c632c7bdb71c453d93b583f9769884bbaffd9b38d012209c7519b5

        SHA512

        ce575e388810b902cd38165c3a492994feb118dda20dabfa574caf72348f1b2db82dc0846dddbdad22fcc6591cfe9a0ad624f66478f8b4e3bd7ee2ad196cb550

      • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uQ8Vn7Ot.exe

        Filesize

        761KB

        MD5

        e2ebe270126361a0f65f8b5c742389bd

        SHA1

        d16ec57fea2045302670dd2655d65a7931ee7720

        SHA256

        dbaa18d1015ea9952a88d4db629039a5f61785111270671108a5920c45dc7e3e

        SHA512

        45fe955b64186d5e740731bff07ca4ce539a2a38b3d19ef23120e33727c918885757efc981bf9fc6943931e20ac8648224cc377f8bb3f571b1e143ba4011ef87

      • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ml4Mq9ov.exe

        Filesize

        565KB

        MD5

        94d2ec7febd5a7510bcbf676327f2a42

        SHA1

        82bebd16345968040eebad5b28ee3f6f87e718ec

        SHA256

        9fd883b4239563c50755949aae8efaeb95e5f5fae6b0dee79cacda42eb4da376

        SHA512

        8d1fe3a0d89ca7beb5ce38dec39597d37948d3f45934aacfc3c8d2ba0f82b7f96a03f4644ad6593d8c9f1ce96080e8e9b34f08595fa502bd17ea39763287aefa

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yi85Az5.exe

        Filesize

        1.1MB

        MD5

        4d2db66e83272c2a889aa3e663820aa9

        SHA1

        b2c5210b6e869a69795e989e8a6217aa0da447a0

        SHA256

        f2ed5b3b4a312286bcea31edce4b1ea666d705727e2e5548c026b9c13a32627e

        SHA512

        79042c34f7cc2a0a8b3aeba8a11f490364876361b496348680115c17a83fff59921729ffdbd17941b1bf238bd4a4a00528443d71967b222ab1ac8b9f7e687c24

      • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2oe768ZT.exe

        Filesize

        222KB

        MD5

        5b67520db93aa50f8cc2083033553f77

        SHA1

        92b935f43282e450584b49dd6e1eab3feef36223

        SHA256

        ee60ebf688fd103fcd5b3cb8e7e5eb6924ad84406361ddefd04e6f2b21317218

        SHA512

        c76f5f3416394b2a256c64a598586cb1b89185b93359439d8310c84742ac53d5cb714d75105d47c8b767f70510176d79603d79572aaab7d8df254698badbd95e

      • memory/232-42-0x0000000000E80000-0x0000000000EBE000-memory.dmp

        Filesize

        248KB

      • memory/232-43-0x00000000081E0000-0x0000000008784000-memory.dmp

        Filesize

        5.6MB

      • memory/232-44-0x0000000007C30000-0x0000000007CC2000-memory.dmp

        Filesize

        584KB

      • memory/232-45-0x0000000007D00000-0x0000000007D0A000-memory.dmp

        Filesize

        40KB

      • memory/232-46-0x0000000008DB0000-0x00000000093C8000-memory.dmp

        Filesize

        6.1MB

      • memory/232-47-0x0000000008060000-0x000000000816A000-memory.dmp

        Filesize

        1.0MB

      • memory/232-48-0x0000000007DE0000-0x0000000007DF2000-memory.dmp

        Filesize

        72KB

      • memory/232-49-0x0000000007F50000-0x0000000007F8C000-memory.dmp

        Filesize

        240KB

      • memory/232-50-0x0000000007F90000-0x0000000007FDC000-memory.dmp

        Filesize

        304KB

      • memory/3576-38-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3576-36-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB

      • memory/3576-35-0x0000000000400000-0x0000000000434000-memory.dmp

        Filesize

        208KB