Overview
overview
10Static
static
30d301494f1...b9.exe
windows10-2004-x64
1017123cde24...76.exe
windows10-2004-x64
103513e5a1be...0b.exe
windows10-2004-x64
103548eb3ee0...c3.exe
windows10-2004-x64
1037bb007e1a...b5.exe
windows10-2004-x64
103b8019115c...d8.exe
windows10-2004-x64
103ba16fdd2a...8a.exe
windows10-2004-x64
103c47d4d72a...e8.exe
windows10-2004-x64
105598d9028e...fd.exe
windows7-x64
105598d9028e...fd.exe
windows10-2004-x64
105d95f47641...f4.exe
windows10-2004-x64
1061d857a524...a5.exe
windows10-2004-x64
1064f004d4a2...36.exe
windows10-2004-x64
107787b07a17...49.exe
windows10-2004-x64
107cc3996906...7e.exe
windows10-2004-x64
10825d0619a8...ce.exe
windows10-2004-x64
109e6f3fd3f7...c2.exe
windows10-2004-x64
10a49c96afc3...92.exe
windows10-2004-x64
10e2945d600c...9e.exe
windows10-2004-x64
10eb8cedd00b...3b.exe
windows10-2004-x64
10f9bdee7f3d...5b.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
0d301494f1fd79496a102de54faf16772306d560cc125b858d5e57a6e12787b9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
17123cde248bf04440dd66e0818e707111a27baaf0a0f8b46803653840d0f776.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
3513e5a1bef31ae0f1858b98a4a405bb6b73e0c22654ea595cfe351e68560d0b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
3548eb3ee082140f111579d722d1924acef2c914601158aa407cc48e37e04dc3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
37bb007e1a7b802fb160d31d43e6ee29920fb53b1d37beda1c042d893778cab5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
3ba16fdd2a3366af19641ad21ef4ff828edfd310b6fd8c6b4e24aa854d8a668a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
5598d9028e8f5dbcce57fc5044a12a3e254972b90687bd0e2d8e20298065c3fd.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
5598d9028e8f5dbcce57fc5044a12a3e254972b90687bd0e2d8e20298065c3fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
5d95f476419d3a3135715f2eed0aa6de69b130436772d29100fd7870a2c450f4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
64f004d4a260338ba4eea50516df52087bab791fd6eb50d0b4eb189e6e13bb36.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
825d0619a846701eef20b8c0a10ac730a81fefda0f8afdbe06a54bd4251541ce.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
9e6f3fd3f785137a445cbe56ff06c292a6df24180f53811fc86132a2bd4859c2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
a49c96afc3e1c86dfaa9e2002f5ce95dbdee44cf71bf78474eaa2ab199a57f92.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
e2945d600c8d0d3d77a8528637dcb944f9c51be150c7dd4e619a249b7b9a309e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
f9bdee7f3daff1675551aa7b8f0eba683dba4df9a9998cc5de0b9da0a577135b.exe
Resource
win10v2004-20240426-en
General
-
Target
7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe
-
Size
640KB
-
MD5
45232eeafc041f4392d43ff89aa99465
-
SHA1
1ed7227336f31558c8c6b1be8c5a50bde622ad36
-
SHA256
7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e
-
SHA512
35873d313709d05b382afc8659f54b6631388cbc1e5b9b1c65eeec961c396fbb9afa6c8f1a429c1f217d96ea042a6bb67c74aa18e49eeedc3b09360c3d21af91
-
SSDEEP
12288:oMrUy90Mxu2w9HDNHaPLLPNvbGB8IAxwhTNc9XeX9:MyXMx6PLLPNjGB8vYTNrN
Malware Config
Extracted
redline
lutyr
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral15/memory/1376-14-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral15/memory/1376-18-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral15/memory/1376-16-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral15/memory/1376-15-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral15/files/0x0007000000023415-20.dat family_redline behavioral15/memory/1964-22-0x0000000000810000-0x000000000084E000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
pid Process 1364 Wj2kr2vj.exe 1480 1nm54nt8.exe 1964 2un039lc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Wj2kr2vj.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1480 set thread context of 1376 1480 1nm54nt8.exe 87 -
Program crash 2 IoCs
pid pid_target Process procid_target 1440 1480 WerFault.exe 85 3980 1376 WerFault.exe 87 -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2616 wrote to memory of 1364 2616 7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe 84 PID 2616 wrote to memory of 1364 2616 7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe 84 PID 2616 wrote to memory of 1364 2616 7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe 84 PID 1364 wrote to memory of 1480 1364 Wj2kr2vj.exe 85 PID 1364 wrote to memory of 1480 1364 Wj2kr2vj.exe 85 PID 1364 wrote to memory of 1480 1364 Wj2kr2vj.exe 85 PID 1480 wrote to memory of 3092 1480 1nm54nt8.exe 86 PID 1480 wrote to memory of 3092 1480 1nm54nt8.exe 86 PID 1480 wrote to memory of 3092 1480 1nm54nt8.exe 86 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1480 wrote to memory of 1376 1480 1nm54nt8.exe 87 PID 1364 wrote to memory of 1964 1364 Wj2kr2vj.exe 94 PID 1364 wrote to memory of 1964 1364 Wj2kr2vj.exe 94 PID 1364 wrote to memory of 1964 1364 Wj2kr2vj.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe"C:\Users\Admin\AppData\Local\Temp\7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wj2kr2vj.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wj2kr2vj.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nm54nt8.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nm54nt8.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:3092
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1376
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 5405⤵
- Program crash
PID:3980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 5924⤵
- Program crash
PID:1440
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2un039lc.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2un039lc.exe3⤵
- Executes dropped EXE
PID:1964
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1376 -ip 13761⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1480 -ip 14801⤵PID:4960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD5636a9df2e421e343ce95dd422947e9a7
SHA1f934f3db17070f1ebbde16b238270ad961816af5
SHA2561ea5ebb242a1a9dfe4eedc3d16d65d66aca05febc7c1dfbb81c65e3edaaddfed
SHA512cded219c5dbc0f790ca94c8c4aecf948c9a0f1e2e5a8c975fee5ec08dfd7cf24de084ba0f78ac5fbf3a21c46ec9676f13f8ceebe2007397615e60288d021b780
-
Filesize
423KB
MD5f495032b690e17b37956a2a5b8d4c556
SHA197409a7b3e89336c0d68d8fa4e459a0e81d9dc38
SHA2567bb120577c0c26dafbc1a1cd08f88cee65bd35365a81090a61d7f6185b064c61
SHA512bef64a261fa24c6c5af5816ebb8549d3f404df55271ff03347be4772f9d940940bbd3b0cbec01caa41ded78422a60381fea8cd8434eabdc3c36e3889b3a180d6
-
Filesize
221KB
MD57175a8376d238e9f3ea71ccbdb176182
SHA12ce5f9c75e5829587c9a0ff3a78ce9f695787699
SHA2562a0f850c6325fe494da648a4b15c9eb8c5217e1637a346eb763e8cd27e7c24f7
SHA512be51366af44b47fc50336f4aae339c25c5e8e3d5a90867569112c198a7fc16688207b02cfa99764296928f6b82acebf9417805944ffb63b559d7fec169ad42f5