Overview
overview
10Static
static
30e266a7216...9f.exe
windows10-2004-x64
100fed7be9f1...18.exe
windows10-2004-x64
1016ac715816...ea.exe
windows10-2004-x64
1026c470a8b0...9a.exe
windows10-2004-x64
102d47818e79...79.exe
windows10-2004-x64
102e6c446801...a5.exe
windows7-x64
102e6c446801...a5.exe
windows10-2004-x64
102f02d9074f...e7.exe
windows10-2004-x64
104d1fc94da1...dc.exe
windows10-2004-x64
10521f6870a3...07.exe
windows10-2004-x64
105e01d698ad...d1.exe
windows10-2004-x64
107dc4ebbe25...36.exe
windows10-2004-x64
10862a8f43d1...32.exe
windows10-2004-x64
10ba494624ee...0c.exe
windows10-2004-x64
10ba4c5213c0...28.exe
windows10-2004-x64
10bbfb7f577d...dc.exe
windows10-2004-x64
10be3d316058...ca.exe
windows10-2004-x64
10e1d166047d...d0.exe
windows10-2004-x64
10e56b24cbcd...10.exe
windows10-2004-x64
10ef4487829b...03.exe
windows10-2004-x64
10fdbb9a49cd...e7.exe
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 19:05
Static task
static1
Behavioral task
behavioral1
Sample
0e266a72166321124c500c505eac80a998786768d1c1e7be12c0c09adbdb969f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
0fed7be9f1bc5655b7c37c7839da72b6233320884e7029c3ca465ec9fa0bdc18.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
26c470a8b0d923529cb630dee55e87b901f38e0ee675c3213b68e8b1db239e9a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
2d47818e79d8f9acc3caa85a2d99191ec3eff5843f379ecb9acf5e8610da5279.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
2e6c446801978c45f270ec540c0c9884a83b944218fb00b16d7091ab41c28ca5.exe
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
2e6c446801978c45f270ec540c0c9884a83b944218fb00b16d7091ab41c28ca5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
2f02d9074fc5208b7b3e27f59a5867d15d3e0fa8490020ad8680b051f00a27e7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
4d1fc94da13e115d0cfb24b80df5875a92e199a440121a1fe8c37f1258ef23dc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
521f6870a363ff65470792799f32a31b9a55349765195a9c0e5e0d64ffa38307.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
5e01d698adb505dae22bf133909e0103e980c2f29ad0c1eecdf47f2487dafed1.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral12
Sample
7dc4ebbe254d4cbc8e93064098173786d7ed5aa42b3c8d4abb55678e250a4b36.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
862a8f43d1bd92e93fbfad58f9943a043f45ae975ab50181d393ffb2fa848532.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral14
Sample
ba494624eebd5343a245e58b1f24e0044ccb4c80897feb6a13e393719d23900c.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
ba4c5213c01fa30e0752b610dd412c61729c7ecd046fa9a5bdde3b5bcccb9a28.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
bbfb7f577d81fe47e80446b1eb11e1623a98b25decf06d6089302a7f9aa51adc.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
be3d3160582a8debaa43a4fd41c15c9912c7e9f9fd4b736991afb8ad220ebfca.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
e1d166047db27931c64d2750c2c0d4d27bb57655e624d6cd5eeed46b63a5cbd0.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
e56b24cbcd2f2dc78ead0bbfb6d673cbd44be4ae5db1dbbf9a1fdb709103d010.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
fdbb9a49cd039fc64f0cf2a64961e3168c0210a03dc0283c09dcd5f5d1b00ce7.exe
Resource
win10v2004-20240508-en
General
-
Target
ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe
-
Size
782KB
-
MD5
99f433c7c2dea73b9bb35968e439ee4b
-
SHA1
c0c0ac8833349be06b8689011fe83697167d4aad
-
SHA256
ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903
-
SHA512
5d50aba2dcd8f276f6e855506fe35de69ba9aa6993ecb673b9b8eb741576c9ea8f71bffddb29f527743e29e9c1331866e2ed1429da6a149de4898b803af7a1a2
-
SSDEEP
12288:5Mr/y90EWMGWa4K+Zh6dqf8pJ+0DGQplKkXEFG1+gzXlaJi07IfRMLN:SyHQW8Swm8/SQD3EFG4grlaJPoRM5
Malware Config
Extracted
redline
kukish
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral20/memory/1952-14-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family behavioral20/memory/1952-15-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family behavioral20/memory/1952-18-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family behavioral20/memory/1952-16-0x0000000000400000-0x0000000000432000-memory.dmp mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2aO021mb.exe family_redline behavioral20/memory/1448-22-0x00000000000C0000-0x00000000000FE000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
tq8ih1Og.exe1oA01ud0.exe2aO021mb.exepid process 4580 tq8ih1Og.exe 1332 1oA01ud0.exe 1448 2aO021mb.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exetq8ih1Og.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" tq8ih1Og.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1oA01ud0.exedescription pid process target process PID 1332 set thread context of 1952 1332 1oA01ud0.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1940 1952 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exetq8ih1Og.exe1oA01ud0.exedescription pid process target process PID 2420 wrote to memory of 4580 2420 ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe tq8ih1Og.exe PID 2420 wrote to memory of 4580 2420 ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe tq8ih1Og.exe PID 2420 wrote to memory of 4580 2420 ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe tq8ih1Og.exe PID 4580 wrote to memory of 1332 4580 tq8ih1Og.exe 1oA01ud0.exe PID 4580 wrote to memory of 1332 4580 tq8ih1Og.exe 1oA01ud0.exe PID 4580 wrote to memory of 1332 4580 tq8ih1Og.exe 1oA01ud0.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 1332 wrote to memory of 1952 1332 1oA01ud0.exe AppLaunch.exe PID 4580 wrote to memory of 1448 4580 tq8ih1Og.exe 2aO021mb.exe PID 4580 wrote to memory of 1448 4580 tq8ih1Og.exe 2aO021mb.exe PID 4580 wrote to memory of 1448 4580 tq8ih1Og.exe 2aO021mb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe"C:\Users\Admin\AppData\Local\Temp\ef4487829bbec1eb751da8fe7227f27dccd52cd7f16d1d5d8bdcd1af42b36903.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tq8ih1Og.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tq8ih1Og.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1oA01ud0.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1oA01ud0.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1952 -s 5405⤵
- Program crash
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2aO021mb.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2aO021mb.exe3⤵
- Executes dropped EXE
PID:1448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1952 -ip 19521⤵PID:4772
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3808 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:4800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
581KB
MD5792788a19aef936cbbbcd779f637ebdd
SHA13f8a86b11d5fa887ea0a5ca56c7545ca2fe90d09
SHA2563d07aca31670722822aaa64de071875ff192c514b937824c1fca0bea2a8f2ca5
SHA51217cdfe55eed14b3404510894fb8972f173cee38d4081e1e12ec9cff52fc445ee407c82dfc8f557a3daffe7b0ca60c2f4f2690ccd504a2fa062edc27dca883abd
-
Filesize
1.1MB
MD56ef68ec5b2d91cbc9c66fa0553e527ec
SHA18d8ab02a5f2433cf12ba62336e4d774f2bbf21d2
SHA2568ffa8c6bcf0b38b229ac57e8a8eacfad2d27bd2b6ec971af827609bfb919495f
SHA5121a02ccdf3d1be279169bc25eb2a4452be337389b78050811ea4367ca624d5d169c7c7e157a73fe3be13378412e8d94606f41c157b5892cc76c4344ee85d204a6
-
Filesize
222KB
MD56ce5b1b4d600c87f2e975f20550e4378
SHA15e98efcb0192d913e69424e187709e829e900504
SHA25661accbf7fb893486d33dd53b50c38dc7a5d294813c19afa4eb223147b363fab6
SHA5120165e2f22cc3be87911cb0256b2d1197bbdd53f4732ec2e05b443805a19a4f9ff70331061a4fb31197986ca981eda496e08b36224221ac9f89462c7d6146ccb2