Overview
overview
10Static
static
30e5866c048...02.exe
windows10-2004-x64
10168a3cbbca...f6.exe
windows10-2004-x64
1023530bfa27...e2.exe
windows10-2004-x64
1025974ec913...91.exe
windows10-2004-x64
1029e8eb905d...57.exe
windows10-2004-x64
102ff2598373...ce.exe
windows10-2004-x64
1030a7bebd46...c4.exe
windows10-2004-x64
1036848c0be9...d8.exe
windows10-2004-x64
10369e096918...34.exe
windows10-2004-x64
10397f0bf375...c6.exe
windows10-2004-x64
103a437fa895...c1.exe
windows10-2004-x64
103f23e445a9...39.exe
windows10-2004-x64
1044dedbcb8a...5f.exe
windows10-2004-x64
106aec122dba...ee.exe
windows10-2004-x64
10b0d3a36603...55.exe
windows10-2004-x64
10b4f17a4609...a2.exe
windows10-2004-x64
10d2d831c046...51.exe
windows10-2004-x64
10da40ec1cf9...48.exe
windows10-2004-x64
10e7a2b48b9e...75.exe
windows10-2004-x64
10f07691246e...f6.exe
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
0e5866c0482cf393f74fa629a43250b2a3d3c45a5c86eda348a71f8d88c5da02.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
23530bfa27653b3a30a5c3778bc7c58fac12efe736252f4527f831347afec4e2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
25974ec913921f8a9dbf6d175cbf975173e12a47c730f07db9ff7336aa799391.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
29e8eb905dd243a014498d2c372ce7c07306a13d8848307d94468ecc7f523557.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2ff2598373e4f2608549579f5029d8c3106c485e2d1768ec605951faad4c9ace.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
369e096918ca2cc20f1329b7cf7076b3fabb1107c1cb2113ef54eeda92e41e34.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
397f0bf37598f6fd4fd6a8933cfdbaebedc80de5b8929b28899fdcf9b7ba0cc6.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
3a437fa89562e5fc34e761a6ede9c12aa1d8ef1be68ac45a97f3719b864fd8c1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
3f23e445a9c2f529b4cbc3f4ee40ef64fa1fe69a8d4a241b103ec8c749376239.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
b0d3a3660331ff8ff0504498edd9bff28eeb733ac6d718bd589cac5bf7c59855.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
b4f17a4609e2cec3a4889b16b6afbe340483f8403878fb6bc6d524be8e5764a2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
da40ec1cf90ce4636876a76bd250b12ca3df8f973c3aa4752203ce19ac39a548.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
e7a2b48b9e169ff5a481fe8fb2f4f1d9a8ce2a823d5e2140cb1f264b7f525175.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
f07691246ef6b1342b6b3c147dc49c2f4a89eec24e4f141c8ff8768bbc4711f6.exe
Resource
win10v2004-20240508-en
General
-
Target
168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe
-
Size
1.5MB
-
MD5
827616c5464fcc383ad3ef0ea187e34a
-
SHA1
ecded2c0f2ac47d156bebc9c7ce360b1ef471ff1
-
SHA256
168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6
-
SHA512
985d13422ec4efd209147a1009d42be01e74e785a8256f0c07a9991fa30710897491a0fc9beb8d29b42a279a5639a87650dc4a6028ef1e871a5de5ebc6e1d67a
-
SSDEEP
24576:5yf7bF2EiBtiau3+RH2VxEm0Lm23oliLiR9+FDTkx1lveYOrMgBA7cFmhIrUeTr:sfXFfiKORH2XEm0Ld4llR4hgxHveJr/O
Malware Config
Extracted
redline
kinza
77.91.124.86:19084
Signatures
-
Detect Mystic stealer payload 3 IoCs
resource yara_rule behavioral2/memory/3576-35-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral2/memory/3576-38-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family behavioral2/memory/3576-36-0x0000000000400000-0x0000000000434000-memory.dmp mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/files/0x0007000000023299-40.dat family_redline behavioral2/memory/232-42-0x0000000000E80000-0x0000000000EBE000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
pid Process 4660 wq5qV4tA.exe 1616 lP8WU7wL.exe 1744 uQ8Vn7Ot.exe 1048 ml4Mq9ov.exe 1580 1Yi85Az5.exe 232 2oe768ZT.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" wq5qV4tA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" lP8WU7wL.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" uQ8Vn7Ot.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" ml4Mq9ov.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1580 set thread context of 3576 1580 1Yi85Az5.exe 96 -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1260 wrote to memory of 4660 1260 168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe 91 PID 1260 wrote to memory of 4660 1260 168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe 91 PID 1260 wrote to memory of 4660 1260 168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe 91 PID 4660 wrote to memory of 1616 4660 wq5qV4tA.exe 92 PID 4660 wrote to memory of 1616 4660 wq5qV4tA.exe 92 PID 4660 wrote to memory of 1616 4660 wq5qV4tA.exe 92 PID 1616 wrote to memory of 1744 1616 lP8WU7wL.exe 93 PID 1616 wrote to memory of 1744 1616 lP8WU7wL.exe 93 PID 1616 wrote to memory of 1744 1616 lP8WU7wL.exe 93 PID 1744 wrote to memory of 1048 1744 uQ8Vn7Ot.exe 94 PID 1744 wrote to memory of 1048 1744 uQ8Vn7Ot.exe 94 PID 1744 wrote to memory of 1048 1744 uQ8Vn7Ot.exe 94 PID 1048 wrote to memory of 1580 1048 ml4Mq9ov.exe 95 PID 1048 wrote to memory of 1580 1048 ml4Mq9ov.exe 95 PID 1048 wrote to memory of 1580 1048 ml4Mq9ov.exe 95 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1580 wrote to memory of 3576 1580 1Yi85Az5.exe 96 PID 1048 wrote to memory of 232 1048 ml4Mq9ov.exe 97 PID 1048 wrote to memory of 232 1048 ml4Mq9ov.exe 97 PID 1048 wrote to memory of 232 1048 ml4Mq9ov.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe"C:\Users\Admin\AppData\Local\Temp\168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wq5qV4tA.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\wq5qV4tA.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lP8WU7wL.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lP8WU7wL.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uQ8Vn7Ot.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\uQ8Vn7Ot.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ml4Mq9ov.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\ml4Mq9ov.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yi85Az5.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Yi85Az5.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3576
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2oe768ZT.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2oe768ZT.exe6⤵
- Executes dropped EXE
PID:232
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:4468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD55f5f1612ea1e4ba87701c432ea80c1b1
SHA1207c9c55d5a5b58190864ec5980ac8ff8d99ac83
SHA256a807a9f78807fb7b008068acd1bde0f1dc2fc5e627b9cbc9f6f2bc4cec59167b
SHA5125143bbeeb4fa3f10499a1e1a7dc0b3cc662d2780bcf1f4a95f9cf6f682ae759945274f10a3d4c8a51907f9db7753e1e4dc1fae6e2c98f72e14c4ee6c91cad43d
-
Filesize
1.2MB
MD5d6ea073af1e8f79264a214fdc34ed195
SHA1925ded893445fe4e068739cb9af00f0f2f4e6ea0
SHA256a8ac35d6a8c632c7bdb71c453d93b583f9769884bbaffd9b38d012209c7519b5
SHA512ce575e388810b902cd38165c3a492994feb118dda20dabfa574caf72348f1b2db82dc0846dddbdad22fcc6591cfe9a0ad624f66478f8b4e3bd7ee2ad196cb550
-
Filesize
761KB
MD5e2ebe270126361a0f65f8b5c742389bd
SHA1d16ec57fea2045302670dd2655d65a7931ee7720
SHA256dbaa18d1015ea9952a88d4db629039a5f61785111270671108a5920c45dc7e3e
SHA51245fe955b64186d5e740731bff07ca4ce539a2a38b3d19ef23120e33727c918885757efc981bf9fc6943931e20ac8648224cc377f8bb3f571b1e143ba4011ef87
-
Filesize
565KB
MD594d2ec7febd5a7510bcbf676327f2a42
SHA182bebd16345968040eebad5b28ee3f6f87e718ec
SHA2569fd883b4239563c50755949aae8efaeb95e5f5fae6b0dee79cacda42eb4da376
SHA5128d1fe3a0d89ca7beb5ce38dec39597d37948d3f45934aacfc3c8d2ba0f82b7f96a03f4644ad6593d8c9f1ce96080e8e9b34f08595fa502bd17ea39763287aefa
-
Filesize
1.1MB
MD54d2db66e83272c2a889aa3e663820aa9
SHA1b2c5210b6e869a69795e989e8a6217aa0da447a0
SHA256f2ed5b3b4a312286bcea31edce4b1ea666d705727e2e5548c026b9c13a32627e
SHA51279042c34f7cc2a0a8b3aeba8a11f490364876361b496348680115c17a83fff59921729ffdbd17941b1bf238bd4a4a00528443d71967b222ab1ac8b9f7e687c24
-
Filesize
222KB
MD55b67520db93aa50f8cc2083033553f77
SHA192b935f43282e450584b49dd6e1eab3feef36223
SHA256ee60ebf688fd103fcd5b3cb8e7e5eb6924ad84406361ddefd04e6f2b21317218
SHA512c76f5f3416394b2a256c64a598586cb1b89185b93359439d8310c84742ac53d5cb714d75105d47c8b767f70510176d79603d79572aaab7d8df254698badbd95e