Analysis

  • max time kernel
    148s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-05-2024 11:07

General

  • Target

    7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe

  • Size

    640KB

  • MD5

    45232eeafc041f4392d43ff89aa99465

  • SHA1

    1ed7227336f31558c8c6b1be8c5a50bde622ad36

  • SHA256

    7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e

  • SHA512

    35873d313709d05b382afc8659f54b6631388cbc1e5b9b1c65eeec961c396fbb9afa6c8f1a429c1f217d96ea042a6bb67c74aa18e49eeedc3b09360c3d21af91

  • SSDEEP

    12288:oMrUy90Mxu2w9HDNHaPLLPNvbGB8IAxwhTNc9XeX9:MyXMx6PLLPNjGB8vYTNrN

Malware Config

Extracted

Family

redline

Botnet

lutyr

C2

77.91.124.55:19071

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe
    "C:\Users\Admin\AppData\Local\Temp\7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2616
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wj2kr2vj.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wj2kr2vj.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1364
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nm54nt8.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nm54nt8.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1480
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
            PID:3092
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
            4⤵
              PID:1376
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 540
                5⤵
                • Program crash
                PID:3980
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 592
              4⤵
              • Program crash
              PID:1440
          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2un039lc.exe
            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2un039lc.exe
            3⤵
            • Executes dropped EXE
            PID:1964
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1376 -ip 1376
        1⤵
          PID:448
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1480 -ip 1480
          1⤵
            PID:4960

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wj2kr2vj.exe

            Filesize

            444KB

            MD5

            636a9df2e421e343ce95dd422947e9a7

            SHA1

            f934f3db17070f1ebbde16b238270ad961816af5

            SHA256

            1ea5ebb242a1a9dfe4eedc3d16d65d66aca05febc7c1dfbb81c65e3edaaddfed

            SHA512

            cded219c5dbc0f790ca94c8c4aecf948c9a0f1e2e5a8c975fee5ec08dfd7cf24de084ba0f78ac5fbf3a21c46ec9676f13f8ceebe2007397615e60288d021b780

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nm54nt8.exe

            Filesize

            423KB

            MD5

            f495032b690e17b37956a2a5b8d4c556

            SHA1

            97409a7b3e89336c0d68d8fa4e459a0e81d9dc38

            SHA256

            7bb120577c0c26dafbc1a1cd08f88cee65bd35365a81090a61d7f6185b064c61

            SHA512

            bef64a261fa24c6c5af5816ebb8549d3f404df55271ff03347be4772f9d940940bbd3b0cbec01caa41ded78422a60381fea8cd8434eabdc3c36e3889b3a180d6

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2un039lc.exe

            Filesize

            221KB

            MD5

            7175a8376d238e9f3ea71ccbdb176182

            SHA1

            2ce5f9c75e5829587c9a0ff3a78ce9f695787699

            SHA256

            2a0f850c6325fe494da648a4b15c9eb8c5217e1637a346eb763e8cd27e7c24f7

            SHA512

            be51366af44b47fc50336f4aae339c25c5e8e3d5a90867569112c198a7fc16688207b02cfa99764296928f6b82acebf9417805944ffb63b559d7fec169ad42f5

          • memory/1376-14-0x0000000000400000-0x0000000000433000-memory.dmp

            Filesize

            204KB

          • memory/1376-18-0x0000000000400000-0x0000000000433000-memory.dmp

            Filesize

            204KB

          • memory/1376-16-0x0000000000400000-0x0000000000433000-memory.dmp

            Filesize

            204KB

          • memory/1376-15-0x0000000000400000-0x0000000000433000-memory.dmp

            Filesize

            204KB

          • memory/1964-23-0x0000000007C50000-0x00000000081F4000-memory.dmp

            Filesize

            5.6MB

          • memory/1964-22-0x0000000000810000-0x000000000084E000-memory.dmp

            Filesize

            248KB

          • memory/1964-24-0x0000000007740000-0x00000000077D2000-memory.dmp

            Filesize

            584KB

          • memory/1964-25-0x0000000002B50000-0x0000000002B5A000-memory.dmp

            Filesize

            40KB

          • memory/1964-26-0x0000000008820000-0x0000000008E38000-memory.dmp

            Filesize

            6.1MB

          • memory/1964-27-0x0000000007A60000-0x0000000007B6A000-memory.dmp

            Filesize

            1.0MB

          • memory/1964-28-0x0000000007900000-0x0000000007912000-memory.dmp

            Filesize

            72KB

          • memory/1964-29-0x0000000007990000-0x00000000079CC000-memory.dmp

            Filesize

            240KB

          • memory/1964-30-0x00000000079D0000-0x0000000007A1C000-memory.dmp

            Filesize

            304KB