Overview
overview
10Static
static
30d301494f1...b9.exe
windows10-2004-x64
1017123cde24...76.exe
windows10-2004-x64
103513e5a1be...0b.exe
windows10-2004-x64
103548eb3ee0...c3.exe
windows10-2004-x64
1037bb007e1a...b5.exe
windows10-2004-x64
103b8019115c...d8.exe
windows10-2004-x64
103ba16fdd2a...8a.exe
windows10-2004-x64
103c47d4d72a...e8.exe
windows10-2004-x64
105598d9028e...fd.exe
windows7-x64
105598d9028e...fd.exe
windows10-2004-x64
105d95f47641...f4.exe
windows10-2004-x64
1061d857a524...a5.exe
windows10-2004-x64
1064f004d4a2...36.exe
windows10-2004-x64
107787b07a17...49.exe
windows10-2004-x64
107cc3996906...7e.exe
windows10-2004-x64
10825d0619a8...ce.exe
windows10-2004-x64
109e6f3fd3f7...c2.exe
windows10-2004-x64
10a49c96afc3...92.exe
windows10-2004-x64
10e2945d600c...9e.exe
windows10-2004-x64
10eb8cedd00b...3b.exe
windows10-2004-x64
10f9bdee7f3d...5b.exe
windows10-2004-x64
10Analysis
-
max time kernel
144s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
0d301494f1fd79496a102de54faf16772306d560cc125b858d5e57a6e12787b9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
17123cde248bf04440dd66e0818e707111a27baaf0a0f8b46803653840d0f776.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
3513e5a1bef31ae0f1858b98a4a405bb6b73e0c22654ea595cfe351e68560d0b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
3548eb3ee082140f111579d722d1924acef2c914601158aa407cc48e37e04dc3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
37bb007e1a7b802fb160d31d43e6ee29920fb53b1d37beda1c042d893778cab5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
3ba16fdd2a3366af19641ad21ef4ff828edfd310b6fd8c6b4e24aa854d8a668a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
5598d9028e8f5dbcce57fc5044a12a3e254972b90687bd0e2d8e20298065c3fd.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
5598d9028e8f5dbcce57fc5044a12a3e254972b90687bd0e2d8e20298065c3fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
5d95f476419d3a3135715f2eed0aa6de69b130436772d29100fd7870a2c450f4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
64f004d4a260338ba4eea50516df52087bab791fd6eb50d0b4eb189e6e13bb36.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
825d0619a846701eef20b8c0a10ac730a81fefda0f8afdbe06a54bd4251541ce.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
9e6f3fd3f785137a445cbe56ff06c292a6df24180f53811fc86132a2bd4859c2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
a49c96afc3e1c86dfaa9e2002f5ce95dbdee44cf71bf78474eaa2ab199a57f92.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
e2945d600c8d0d3d77a8528637dcb944f9c51be150c7dd4e619a249b7b9a309e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
f9bdee7f3daff1675551aa7b8f0eba683dba4df9a9998cc5de0b9da0a577135b.exe
Resource
win10v2004-20240426-en
General
-
Target
eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe
-
Size
884KB
-
MD5
a2acde444a301a3c84598b3fb8c6c4da
-
SHA1
cadafcf1e96bac636ff9d5da45cc79b62864aa0f
-
SHA256
eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b
-
SHA512
9242447c31e6be528f2fa050f18aa607428e49d2b572cd797adbf43f38dced96c5ca16fd6b0581b17fc0a9406199e481faa99150cb9e646578672561bf00285f
-
SSDEEP
12288:fMr/y90MTkylNO613IvNm1n3Or+tJYiF/ZvpP1A8Q27IOS9HHMAd:gyndU61D1n3Or+XBZJ1A897PS9HsAd
Malware Config
Extracted
redline
gigant
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 3 IoCs
Processes:
resource yara_rule behavioral20/memory/1528-21-0x0000000000400000-0x0000000000428000-memory.dmp mystic_family behavioral20/memory/1528-22-0x0000000000400000-0x0000000000428000-memory.dmp mystic_family behavioral20/memory/1528-24-0x0000000000400000-0x0000000000428000-memory.dmp mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2NM322Sp.exe family_redline behavioral20/memory/1580-28-0x0000000000120000-0x000000000015E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
Processes:
sk0aN7Be.exeEr3iM5Xh.exe1DW33ET8.exe2NM322Sp.exepid process 1728 sk0aN7Be.exe 4464 Er3iM5Xh.exe 3480 1DW33ET8.exe 1580 2NM322Sp.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
Er3iM5Xh.exeeb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exesk0aN7Be.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" Er3iM5Xh.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sk0aN7Be.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1DW33ET8.exedescription pid process target process PID 3480 set thread context of 1528 3480 1DW33ET8.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3516 3480 WerFault.exe 1DW33ET8.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exesk0aN7Be.exeEr3iM5Xh.exe1DW33ET8.exedescription pid process target process PID 4008 wrote to memory of 1728 4008 eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe sk0aN7Be.exe PID 4008 wrote to memory of 1728 4008 eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe sk0aN7Be.exe PID 4008 wrote to memory of 1728 4008 eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe sk0aN7Be.exe PID 1728 wrote to memory of 4464 1728 sk0aN7Be.exe Er3iM5Xh.exe PID 1728 wrote to memory of 4464 1728 sk0aN7Be.exe Er3iM5Xh.exe PID 1728 wrote to memory of 4464 1728 sk0aN7Be.exe Er3iM5Xh.exe PID 4464 wrote to memory of 3480 4464 Er3iM5Xh.exe 1DW33ET8.exe PID 4464 wrote to memory of 3480 4464 Er3iM5Xh.exe 1DW33ET8.exe PID 4464 wrote to memory of 3480 4464 Er3iM5Xh.exe 1DW33ET8.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 3480 wrote to memory of 1528 3480 1DW33ET8.exe AppLaunch.exe PID 4464 wrote to memory of 1580 4464 Er3iM5Xh.exe 2NM322Sp.exe PID 4464 wrote to memory of 1580 4464 Er3iM5Xh.exe 2NM322Sp.exe PID 4464 wrote to memory of 1580 4464 Er3iM5Xh.exe 2NM322Sp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe"C:\Users\Admin\AppData\Local\Temp\eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sk0aN7Be.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sk0aN7Be.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Er3iM5Xh.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Er3iM5Xh.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1DW33ET8.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1DW33ET8.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵PID:1528
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 5965⤵
- Program crash
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2NM322Sp.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2NM322Sp.exe4⤵
- Executes dropped EXE
PID:1580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3480 -ip 34801⤵PID:668
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
590KB
MD596ff283c100efaf89094a618113c3709
SHA1122c103d15556a781d48287472e4d4c3f6b3b598
SHA25643b3cda3f8e1cb5920a61bcaa710e0b426336360d614795ba231cb3c4c424868
SHA512e6179959cae3675f496bd887bc829a662f3834f5004e83f7fb65f768f155c8cb51fa5cea757ec666ed038c94f5fb87d630d43bc084f395c17962da59426712c9
-
Filesize
417KB
MD5f5fe73580e6061b453e5e52c1b4d1fe2
SHA1e29ff7c20633ba5b052d7bc24e3c056783af2f77
SHA256299663995567ce7e8d92c1a76f6910056efcce778fe83d664f85a3ca9b2e2059
SHA51240e96b896ae52e76ce5ed33cb5f68548b2bef2232721eecb2a2becb6f1523dd786778fd5bf454ef51727a755cb5959f69548139232f4cecb84941a3edb319977
-
Filesize
378KB
MD5f0831f173733de08511f3a0739f278a6
SHA106dc809d653c5d2c97386084ae13b50a73eb5b60
SHA2568b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
SHA51219e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
-
Filesize
231KB
MD59b9cbc983e6c062582f117df47db53c5
SHA1b8ff60c1b709e1f170db8ad7d7197ebadff4dbe6
SHA2566653c670b9c5df02e2ce27619d5881b7ccfa6e4b1927f0b8f062243857204e61
SHA51210532de95cbe17e2c8511f94479b725dab2a4806c380d3d3d856ae5033b109c61b64de7947205859a38dd09fcb47fbd378ff1e29a8237070a471735bf47a27d9