Overview
overview
10Static
static
30e5866c048...02.exe
windows10-2004-x64
10168a3cbbca...f6.exe
windows10-2004-x64
1023530bfa27...e2.exe
windows10-2004-x64
1025974ec913...91.exe
windows10-2004-x64
1029e8eb905d...57.exe
windows10-2004-x64
102ff2598373...ce.exe
windows10-2004-x64
1030a7bebd46...c4.exe
windows10-2004-x64
1036848c0be9...d8.exe
windows10-2004-x64
10369e096918...34.exe
windows10-2004-x64
10397f0bf375...c6.exe
windows10-2004-x64
103a437fa895...c1.exe
windows10-2004-x64
103f23e445a9...39.exe
windows10-2004-x64
1044dedbcb8a...5f.exe
windows10-2004-x64
106aec122dba...ee.exe
windows10-2004-x64
10b0d3a36603...55.exe
windows10-2004-x64
10b4f17a4609...a2.exe
windows10-2004-x64
10d2d831c046...51.exe
windows10-2004-x64
10da40ec1cf9...48.exe
windows10-2004-x64
10e7a2b48b9e...75.exe
windows10-2004-x64
10f07691246e...f6.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23/05/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
0e5866c0482cf393f74fa629a43250b2a3d3c45a5c86eda348a71f8d88c5da02.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
168a3cbbca960033cd4ea67293c3f4f47ded711184772caf9f2050ac2f16cdf6.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
23530bfa27653b3a30a5c3778bc7c58fac12efe736252f4527f831347afec4e2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
25974ec913921f8a9dbf6d175cbf975173e12a47c730f07db9ff7336aa799391.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
29e8eb905dd243a014498d2c372ce7c07306a13d8848307d94468ecc7f523557.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
2ff2598373e4f2608549579f5029d8c3106c485e2d1768ec605951faad4c9ace.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
369e096918ca2cc20f1329b7cf7076b3fabb1107c1cb2113ef54eeda92e41e34.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
397f0bf37598f6fd4fd6a8933cfdbaebedc80de5b8929b28899fdcf9b7ba0cc6.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
3a437fa89562e5fc34e761a6ede9c12aa1d8ef1be68ac45a97f3719b864fd8c1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
3f23e445a9c2f529b4cbc3f4ee40ef64fa1fe69a8d4a241b103ec8c749376239.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
6aec122dba60c94432d6aee116732395d28cda2ecb306d8ab832d137811ceeee.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
b0d3a3660331ff8ff0504498edd9bff28eeb733ac6d718bd589cac5bf7c59855.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
b4f17a4609e2cec3a4889b16b6afbe340483f8403878fb6bc6d524be8e5764a2.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
da40ec1cf90ce4636876a76bd250b12ca3df8f973c3aa4752203ce19ac39a548.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
e7a2b48b9e169ff5a481fe8fb2f4f1d9a8ce2a823d5e2140cb1f264b7f525175.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
f07691246ef6b1342b6b3c147dc49c2f4a89eec24e4f141c8ff8768bbc4711f6.exe
Resource
win10v2004-20240508-en
General
-
Target
36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe
-
Size
434KB
-
MD5
85489a57e51626c1e1a4dcb181b9434a
-
SHA1
458fb04a2fc26ba5b763c6a284ac19e3ba3ac18c
-
SHA256
36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8
-
SHA512
5cc705b5d00058697d2d0b20bd1b5f56fe4637a1f7e07488571cde4b8e3e02a079cbbf5286c13926d55e5ce1140c63bed5a07ec3d12212235554c99ec72ab37e
-
SSDEEP
6144:Kiy+bnr+mp0yN90QEhkZAPjw2Yep7wEL5sl7eo2dTu90J751wojFoheDsmpl6U:yMriy90kbp0LtsU7doSlvhohlmpl6U
Malware Config
Extracted
amadey
3.89
fb0fb8
http://77.91.68.52
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
-
url_paths
/mac/index.php
Extracted
redline
mrak
77.91.124.82:19071
-
auth_value
7d9a335ab5dfd42d374867c96fe25302
Signatures
-
Detect Mystic stealer payload 1 IoCs
resource yara_rule behavioral8/files/0x0007000000023453-24.dat mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral8/files/0x0007000000023450-27.dat family_redline behavioral8/memory/2968-29-0x0000000000CC0000-0x0000000000CF0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation l4551511.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation explonde.exe -
Executes dropped EXE 8 IoCs
pid Process 1752 y1542356.exe 1968 l4551511.exe 3884 explonde.exe 4552 m2151624.exe 2968 n8454255.exe 2476 explonde.exe 536 explonde.exe 2076 explonde.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" y1542356.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3920 schtasks.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2792 wrote to memory of 1752 2792 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe 83 PID 2792 wrote to memory of 1752 2792 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe 83 PID 2792 wrote to memory of 1752 2792 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe 83 PID 1752 wrote to memory of 1968 1752 y1542356.exe 84 PID 1752 wrote to memory of 1968 1752 y1542356.exe 84 PID 1752 wrote to memory of 1968 1752 y1542356.exe 84 PID 1968 wrote to memory of 3884 1968 l4551511.exe 85 PID 1968 wrote to memory of 3884 1968 l4551511.exe 85 PID 1968 wrote to memory of 3884 1968 l4551511.exe 85 PID 1752 wrote to memory of 4552 1752 y1542356.exe 86 PID 1752 wrote to memory of 4552 1752 y1542356.exe 86 PID 1752 wrote to memory of 4552 1752 y1542356.exe 86 PID 2792 wrote to memory of 2968 2792 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe 87 PID 2792 wrote to memory of 2968 2792 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe 87 PID 2792 wrote to memory of 2968 2792 36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe 87 PID 3884 wrote to memory of 3920 3884 explonde.exe 88 PID 3884 wrote to memory of 3920 3884 explonde.exe 88 PID 3884 wrote to memory of 3920 3884 explonde.exe 88 PID 3884 wrote to memory of 3132 3884 explonde.exe 90 PID 3884 wrote to memory of 3132 3884 explonde.exe 90 PID 3884 wrote to memory of 3132 3884 explonde.exe 90 PID 3132 wrote to memory of 3112 3132 cmd.exe 92 PID 3132 wrote to memory of 3112 3132 cmd.exe 92 PID 3132 wrote to memory of 3112 3132 cmd.exe 92 PID 3132 wrote to memory of 2076 3132 cmd.exe 93 PID 3132 wrote to memory of 2076 3132 cmd.exe 93 PID 3132 wrote to memory of 2076 3132 cmd.exe 93 PID 3132 wrote to memory of 4944 3132 cmd.exe 94 PID 3132 wrote to memory of 4944 3132 cmd.exe 94 PID 3132 wrote to memory of 4944 3132 cmd.exe 94 PID 3132 wrote to memory of 2412 3132 cmd.exe 95 PID 3132 wrote to memory of 2412 3132 cmd.exe 95 PID 3132 wrote to memory of 2412 3132 cmd.exe 95 PID 3132 wrote to memory of 4020 3132 cmd.exe 96 PID 3132 wrote to memory of 4020 3132 cmd.exe 96 PID 3132 wrote to memory of 4020 3132 cmd.exe 96 PID 3132 wrote to memory of 548 3132 cmd.exe 97 PID 3132 wrote to memory of 548 3132 cmd.exe 97 PID 3132 wrote to memory of 548 3132 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe"C:\Users\Admin\AppData\Local\Temp\36848c0be9ce6eaebbeca6101443f6ab369e9c84bcb678b2d8f07da9540c66d8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1542356.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1542356.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4551511.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\l4551511.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F5⤵
- Creates scheduled task(s)
PID:3920
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit5⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3112
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"6⤵PID:2076
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E6⤵PID:4944
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2412
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"6⤵PID:4020
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E6⤵PID:548
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2151624.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m2151624.exe3⤵
- Executes dropped EXE
PID:4552
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n8454255.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\n8454255.exe2⤵
- Executes dropped EXE
PID:2968
-
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:2476
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:536
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:2076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
175KB
MD534bfd1840b045673a811454b3fc24f29
SHA1496d647fca5914b6b0a6bf19a6a191ee86fe3254
SHA25672aadb0e14ac8991e62a7acd3709b9a5200a589fa50572026c2bb46b8cad2046
SHA512bc3b624fccf02adb5938e563ce2a46c7b1ef363052d4938d77a534134d8250c8185b06edd5483fb2dd3137cc25912c170c8fcebfd1f15437fb6bfaf5e5fbed44
-
Filesize
279KB
MD505459e863200cdc11035ab929d979b63
SHA15b63449652bbb81ae12547abe450c0c76e72ccbb
SHA256ec19dfdd4935d546c43aa565f22eac74d4388a40a2ebfa0962c93985dc3cbae2
SHA5124a8207b4323d722f30a2d9ca74d90bf9501f19ce38944bf0217aed35b353f8cd5e59efd06433766babaced18eff4add427d68730bbcbb6c8731048dac1974a8d
-
Filesize
219KB
MD59378423d11f258d58a37cbe586a39e03
SHA13016ebe6a0ce5d8d7783324a67dab87e739cedb9
SHA256e083e8e53597cf66d17b7f2aed1b2c4d22e32e9265610f362423d64ff66060f9
SHA51264bb05e3723b8922eaecf93fe7a070ffeebd1cbb642c6ff2ac8ac26cbbda14efcebcb44228f277084bc8a16ea8d600f3b8a91d2f2ab2c6371bee85f90d549624
-
Filesize
141KB
MD5a80db94507e303405f4d4862939a8635
SHA19cfa1de291c6adbb339ab1b479901a9944335742
SHA2562533c13b472a186ec09dce69f017d88d68f517ba0d434b66d63c8266c3d65e0a
SHA512ad7c7df23049eb35b58c8e0481cee38126dea0bcf948e7161fce13731d1504d4e96ab85939d213d36997648b649f8345abac9e82c62be570db038a2ecfa7d278