Overview
overview
10Static
static
306d3b7d2ba...d0.exe
windows10-2004-x64
1008bd377a60...53.exe
windows10-2004-x64
102847bdc35d...e1.exe
windows10-2004-x64
102bed4ea70d...7f.exe
windows10-2004-x64
103ab0d6f60e...46.exe
windows10-2004-x64
103c1c5a94c5...69.exe
windows10-2004-x64
1076530ae1ec...23.exe
windows10-2004-x64
107b80c0170b...d1.exe
windows10-2004-x64
1080633f3a01...36.exe
windows10-2004-x64
10888619cf7b...9e.exe
windows10-2004-x64
108db1b8c1b5...85.exe
windows10-2004-x64
109ea70f7e17...5f.exe
windows10-2004-x64
109f8dd013ec...7e.exe
windows10-2004-x64
10aa0c9ad482...cc.exe
windows10-2004-x64
10aaf88983ad...f6.exe
windows10-2004-x64
10b12a5fda99...06.exe
windows10-2004-x64
10b754f77f3f...44.exe
windows10-2004-x64
10c6c6e2b36c...88.exe
windows10-2004-x64
10dce2842856...6c.exe
windows10-2004-x64
10e2d9100264...8e.exe
windows10-2004-x64
10Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 17:46
Static task
static1
Behavioral task
behavioral1
Sample
06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
08bd377a60108ac1b0fcdb1639ae5695e0fbec00f6e9b3a474c7c09bca1a9353.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
2847bdc35d083634a5b96f3182851943508eb7b1bab56011c48f79008c1fa6e1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
2bed4ea70d0e8707549aac41f29fea0c9a994c68cc33636d802429b5694f077f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
3ab0d6f60e85d2715c3d7d4bba0696acfdc80b3976f4f9ae742a64515fae6c46.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral6
Sample
3c1c5a94c544c2a364bd35ce85960c65491d88d7fb81760c2fdfa3e60a24f169.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
76530ae1ec02b17edec61d3cc10e4d427d09d91fe530ef27c17cd6c848152823.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral8
Sample
7b80c0170b77179545495007e6a16319be71393d2f2cff71b06a4bbe29ff95d1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
80633f3a014bd40bd4c91c797dc27167a21f8db65d64022aaef10763aa7ee936.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral10
Sample
888619cf7bd9be384d2417f8820e45505d191b9faaa048e23a92ae8bf72df29e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
8db1b8c1b564daa7faeb55ace7fba1d91c0794df89a04d3780af99dc7b4fb985.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
9f8dd013ec5282675e933ad77e4db925e8ed2b10bc12f5bee6b62bc0147b0d7e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
aa0c9ad482b23242e3009ff55447fc1f9559ff1412e903acbc14e3ed4c4774cc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
aaf88983ad022d086513c9772cb520815581005e78de7f2ea63f2135933d34f6.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
b12a5fda99550910914026e21295da2406a3d94496d0091261fd72c6336dda06.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
c6c6e2b36cc534a5768d98292b94e03e95b6ecccd57823d6099475b213bcdc88.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
dce2842856c08ba56e502c9ada32f6f2021ca954c80f8cb01420313be7d87f6c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe
Resource
win10v2004-20240508-en
General
-
Target
e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe
-
Size
1.0MB
-
MD5
8ad707306b83faab38fb449d43c45a31
-
SHA1
725d4a61f55a820cf9349d7933ce8ecc6c24a0f0
-
SHA256
e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e
-
SHA512
5b6234453c239da3236cbe9fad5b2be1d56bbbed23bcb3b28c295c173dbea5af3bb7e5f7954baa7eade7ff9c7f32669c67c81ab421102cb7ce3db4c08fd2ab79
-
SSDEEP
24576:myOPsoeMABVFFHw3Yx+1EfLLs2TqoNNIXf:1OP+MuVFFQxAAw/NNI
Malware Config
Extracted
redline
lutyr
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 1 IoCs
resource yara_rule behavioral20/files/0x0008000000023446-19.dat mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral20/files/0x0007000000023447-22.dat family_redline behavioral20/memory/876-24-0x0000000000700000-0x000000000073E000-memory.dmp family_redline -
Executes dropped EXE 4 IoCs
pid Process 1816 Ui4PD2Jb.exe 2056 kv6hK6fu.exe 2984 1hu34BK7.exe 876 2Ro269ha.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" Ui4PD2Jb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kv6hK6fu.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3036 wrote to memory of 1816 3036 e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe 83 PID 3036 wrote to memory of 1816 3036 e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe 83 PID 3036 wrote to memory of 1816 3036 e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe 83 PID 1816 wrote to memory of 2056 1816 Ui4PD2Jb.exe 84 PID 1816 wrote to memory of 2056 1816 Ui4PD2Jb.exe 84 PID 1816 wrote to memory of 2056 1816 Ui4PD2Jb.exe 84 PID 2056 wrote to memory of 2984 2056 kv6hK6fu.exe 85 PID 2056 wrote to memory of 2984 2056 kv6hK6fu.exe 85 PID 2056 wrote to memory of 2984 2056 kv6hK6fu.exe 85 PID 2056 wrote to memory of 876 2056 kv6hK6fu.exe 86 PID 2056 wrote to memory of 876 2056 kv6hK6fu.exe 86 PID 2056 wrote to memory of 876 2056 kv6hK6fu.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe"C:\Users\Admin\AppData\Local\Temp\e2d91002642b377c066dc30f757a804dc6d7ed695d4abae87af60cda84c0098e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ui4PD2Jb.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ui4PD2Jb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kv6hK6fu.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kv6hK6fu.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1hu34BK7.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1hu34BK7.exe4⤵
- Executes dropped EXE
PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ro269ha.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Ro269ha.exe4⤵
- Executes dropped EXE
PID:876
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
522KB
MD55e3c718f75ba98436e4b34ed19876ad3
SHA13b60a0490dbedaaaa84d567da2880240c00be81b
SHA256439ab3b2d23ed021199643053a45b4a9d17e2bacd33e52275d4e22051f1164cf
SHA5128e4d8969ce1acf1866df630e10a445b14d7b77dd3ba3cfc86c04b92ff7093a0175ba361f0f173985bbeac379bd9ea1755dfb04d99703a85342759251c4896cfa
-
Filesize
326KB
MD58235284400fce37c07b00df9b786cc41
SHA19110612637a9a7b32e7db5140526b501ead40a33
SHA2563efdbb0c36bf76a574b523daba5b916acf1427e2a4066efd7ee29e648de8479c
SHA5126931fd0e0c269914b789c3157533a6c9e083c823596bd2a0d7b33374546aefc7f61eff89407569edfb6bde0b7e2532184674af8e1c94b8468d55a36d597aeba1
-
Filesize
190KB
MD5a6656e3d6d06c8ce9cbb4b6952553c20
SHA1af45103616dc896da5ee4268fd5f9483b5b97c1c
SHA256fec303b128c44607654c078736b96d2762722f51b6c473dfe5415158fd83718b
SHA512f53f2214d3f192a352b2a93c66d91988a41a5ab9dbf15edd62ea8ce38da8a732114e3c46526d4dc6f3132330913b1acb90fa11ff454a1520d117149a86678d84
-
Filesize
221KB
MD5dc4b25b7e0afb2399f935b0df995ea5b
SHA15ace7fba55806d1d8912ac0eb647fb1eed78a758
SHA25665d3e5031ae5372ee1c2dc20e265a7a5590bc970b45b53249bbd2fcf4996974c
SHA5122fe24924313b4d6b23c394e59be528e0f0fbef75707008ac99c17acd5f6d2a6938e72561c6e36720dbfc184a0c1173d1080bc4ab1b5aea8e74dfc9ab03844ced