Overview
overview
10Static
static
30d301494f1...b9.exe
windows10-2004-x64
1017123cde24...76.exe
windows10-2004-x64
103513e5a1be...0b.exe
windows10-2004-x64
103548eb3ee0...c3.exe
windows10-2004-x64
1037bb007e1a...b5.exe
windows10-2004-x64
103b8019115c...d8.exe
windows10-2004-x64
103ba16fdd2a...8a.exe
windows10-2004-x64
103c47d4d72a...e8.exe
windows10-2004-x64
105598d9028e...fd.exe
windows7-x64
105598d9028e...fd.exe
windows10-2004-x64
105d95f47641...f4.exe
windows10-2004-x64
1061d857a524...a5.exe
windows10-2004-x64
1064f004d4a2...36.exe
windows10-2004-x64
107787b07a17...49.exe
windows10-2004-x64
107cc3996906...7e.exe
windows10-2004-x64
10825d0619a8...ce.exe
windows10-2004-x64
109e6f3fd3f7...c2.exe
windows10-2004-x64
10a49c96afc3...92.exe
windows10-2004-x64
10e2945d600c...9e.exe
windows10-2004-x64
10eb8cedd00b...3b.exe
windows10-2004-x64
10f9bdee7f3d...5b.exe
windows10-2004-x64
10Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 11:07
Static task
static1
Behavioral task
behavioral1
Sample
0d301494f1fd79496a102de54faf16772306d560cc125b858d5e57a6e12787b9.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
17123cde248bf04440dd66e0818e707111a27baaf0a0f8b46803653840d0f776.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
3513e5a1bef31ae0f1858b98a4a405bb6b73e0c22654ea595cfe351e68560d0b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
3548eb3ee082140f111579d722d1924acef2c914601158aa407cc48e37e04dc3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
37bb007e1a7b802fb160d31d43e6ee29920fb53b1d37beda1c042d893778cab5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
3ba16fdd2a3366af19641ad21ef4ff828edfd310b6fd8c6b4e24aa854d8a668a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
5598d9028e8f5dbcce57fc5044a12a3e254972b90687bd0e2d8e20298065c3fd.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
5598d9028e8f5dbcce57fc5044a12a3e254972b90687bd0e2d8e20298065c3fd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
5d95f476419d3a3135715f2eed0aa6de69b130436772d29100fd7870a2c450f4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
64f004d4a260338ba4eea50516df52087bab791fd6eb50d0b4eb189e6e13bb36.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
7cc399690625fe51c1b469f7e049782a493baa3a1ef701d932c57888bd5d237e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
825d0619a846701eef20b8c0a10ac730a81fefda0f8afdbe06a54bd4251541ce.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
9e6f3fd3f785137a445cbe56ff06c292a6df24180f53811fc86132a2bd4859c2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
a49c96afc3e1c86dfaa9e2002f5ce95dbdee44cf71bf78474eaa2ab199a57f92.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
e2945d600c8d0d3d77a8528637dcb944f9c51be150c7dd4e619a249b7b9a309e.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral20
Sample
eb8cedd00b7ab240f275eb4069c500fbebe244ecae84cca8f1700815583b7f3b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
f9bdee7f3daff1675551aa7b8f0eba683dba4df9a9998cc5de0b9da0a577135b.exe
Resource
win10v2004-20240426-en
General
-
Target
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe
-
Size
696KB
-
MD5
27879b73babd965386e6ea971cd0c265
-
SHA1
af275d236ac0898858ae954208d4731e10e6cc0c
-
SHA256
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8
-
SHA512
2c885e48b4c553cc50d7f917dc54e9fbd8ee3cdd8c1f30bbce4c5af0a07e5e96d03e28aee3143b6dc6b28950ed03222d7fcb7dc5c1893eaaea6039103881e8b3
-
SSDEEP
12288:bMrjy9099lSqc8ni531abDD7za10HlrdMvY112w7JQcVIfGQWsCDDm:Uyg9Iq3i53g40Hvus7mcVIvfCPm
Malware Config
Signatures
-
Detect Mystic stealer payload 3 IoCs
Processes:
resource yara_rule behavioral6/memory/3304-54-0x0000000000400000-0x0000000000428000-memory.dmp mystic_family behavioral6/memory/3304-55-0x0000000000400000-0x0000000000428000-memory.dmp mystic_family behavioral6/memory/3304-57-0x0000000000400000-0x0000000000428000-memory.dmp mystic_family -
Processes:
1rp24xV4.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 1rp24xV4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 1rp24xV4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 1rp24xV4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 1rp24xV4.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection 1rp24xV4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 1rp24xV4.exe -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 4 IoCs
Processes:
MG5EG62.exe1rp24xV4.exe2OW1017.exe3gG70Mz.exepid process 2840 MG5EG62.exe 2936 1rp24xV4.exe 8 2OW1017.exe 1748 3gG70Mz.exe -
Processes:
1rp24xV4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features 1rp24xV4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 1rp24xV4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exeMG5EG62.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" MG5EG62.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2OW1017.exe3gG70Mz.exedescription pid process target process PID 8 set thread context of 3304 8 2OW1017.exe AppLaunch.exe PID 1748 set thread context of 2708 1748 3gG70Mz.exe AppLaunch.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 60 8 WerFault.exe 2OW1017.exe 2744 1748 WerFault.exe 3gG70Mz.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
AppLaunch.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1rp24xV4.exepid process 2936 1rp24xV4.exe 2936 1rp24xV4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1rp24xV4.exedescription pid process Token: SeDebugPrivilege 2936 1rp24xV4.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exeMG5EG62.exe2OW1017.exe3gG70Mz.exedescription pid process target process PID 2440 wrote to memory of 2840 2440 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe MG5EG62.exe PID 2440 wrote to memory of 2840 2440 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe MG5EG62.exe PID 2440 wrote to memory of 2840 2440 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe MG5EG62.exe PID 2840 wrote to memory of 2936 2840 MG5EG62.exe 1rp24xV4.exe PID 2840 wrote to memory of 2936 2840 MG5EG62.exe 1rp24xV4.exe PID 2840 wrote to memory of 2936 2840 MG5EG62.exe 1rp24xV4.exe PID 2840 wrote to memory of 8 2840 MG5EG62.exe 2OW1017.exe PID 2840 wrote to memory of 8 2840 MG5EG62.exe 2OW1017.exe PID 2840 wrote to memory of 8 2840 MG5EG62.exe 2OW1017.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 8 wrote to memory of 3304 8 2OW1017.exe AppLaunch.exe PID 2440 wrote to memory of 1748 2440 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe 3gG70Mz.exe PID 2440 wrote to memory of 1748 2440 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe 3gG70Mz.exe PID 2440 wrote to memory of 1748 2440 3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe 3gG70Mz.exe PID 1748 wrote to memory of 540 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 540 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 540 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 2708 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 2708 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 2708 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 2708 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 2708 1748 3gG70Mz.exe AppLaunch.exe PID 1748 wrote to memory of 2708 1748 3gG70Mz.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe"C:\Users\Admin\AppData\Local\Temp\3b8019115c4ceca7cbcfddbb6bbe680cac9c8811275a16616d40ff294ceb6ed8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MG5EG62.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MG5EG62.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1rp24xV4.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1rp24xV4.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2OW1017.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2OW1017.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 5964⤵
- Program crash
PID:60 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3gG70Mz.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3gG70Mz.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Checks SCSI registry key(s)
PID:2708 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 5603⤵
- Program crash
PID:2744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8 -ip 81⤵PID:3828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1748 -ip 17481⤵PID:4364
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
268KB
MD5f09b788bfb242f8edcb4b4ab2bd0275a
SHA171b2273479460cbda9d08073d0b116935d2c6813
SHA256f291d8694f3198b824474d57a18792218a5d622f2f59370efe6679563db87521
SHA512709bdc1a303159b27f7e7fa793d1c78f3d6223b5a3ba2c03cbea36eafc1bd0e2edc1bd19e61f7ed5ca53a1ab5018d7c171fc9c3c4ff67b02b4087a07cfd5dda6
-
Filesize
452KB
MD50b47b99adb36648c75e59ea8edfe887c
SHA1d9aad265309203b60b9454afac83be056c85d250
SHA256b9c8f23484482dffa45efb6de348db3196b8404ce69a21743a8eb0f44e6da8a0
SHA512f69a3fda19148fac783cb297cd14d8f405b16d44c4aeff6afbd5939981ac7fd521f7d6825ce0a470a37cc7f63024678090b5c8a02f698a61883be87fa9cf4221
-
Filesize
192KB
MD58904f85abd522c7d0cb5789d9583ccff
SHA15b34d8595b37c9e1fb9682b06dc5228efe07f0c6
SHA2567624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f
SHA51204dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12
-
Filesize
378KB
MD5f0831f173733de08511f3a0739f278a6
SHA106dc809d653c5d2c97386084ae13b50a73eb5b60
SHA2568b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
SHA51219e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3