Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-05-2024 08:22

General

  • Target

    c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe

  • Size

    640KB

  • MD5

    0914224943c0087d896a2876e94b3e00

  • SHA1

    573868ff775ff39ff79890046182780d019a48f0

  • SHA256

    c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a

  • SHA512

    921e8b46afa64aa5fe07ec47125ec273ef7722c1ecf796593e0c6cbb527690ebab86eb5849d6a86a4f5a010faa01166c4e8a248805c75d6d22a633f9909e8f9a

  • SSDEEP

    12288:pMroy90uz5t7W35T0tDyS1uuYB0fJr2NcoP4G8g4PGUijAXhp4ey:1y5XKR0xySJbxxox8gZdEx1y

Malware Config

Extracted

Family

redline

Botnet

lutyr

C2

77.91.124.55:19071

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe
    "C:\Users\Admin\AppData\Local\Temp\c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xD6jR1ic.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xD6jR1ic.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:776
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nd48qY3.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nd48qY3.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3200
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          4⤵
            PID:1720
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 540
              5⤵
              • Program crash
              PID:1268
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 600
            4⤵
            • Program crash
            PID:1388
        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2bZ911RA.exe
          C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2bZ911RA.exe
          3⤵
          • Executes dropped EXE
          PID:1632
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3200 -ip 3200
      1⤵
        PID:3740
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1720 -ip 1720
        1⤵
          PID:1344

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xD6jR1ic.exe

          Filesize

          444KB

          MD5

          e3db7fd4d794951a329eea4121f63d6f

          SHA1

          9e1515d34b94d945b9882722f0ac666d22749e3f

          SHA256

          1cccca47a3022f3b233e9e1fb3122f73a400ef2938e6e2cf06b47a57c1500ba9

          SHA512

          ceb23264d453e4f594d29fd7a97c3b4ccfbb50be11f8828ad1df629a8909c6d94e4b4e49c224427f593330209d04d9999fa546e0dd7473796b8cf052fbd61eaa

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nd48qY3.exe

          Filesize

          422KB

          MD5

          0280ebe4f42da1d8476c98e3bb79795a

          SHA1

          2a86fde390205c7ea6c0a515e639a6423d929b9f

          SHA256

          e7e11bc18307b19f8ad86ae301759b08bd9886683c24af76e3ba993feea1792f

          SHA512

          27fcff90c7c16554ab2b453ae4c73204b6ac716ddb8065d5004a49b8a57fd3096efef9f2190b69bdc92c7bd4efed88e785dc5ca605f693bd527c7f60573cabb0

        • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2bZ911RA.exe

          Filesize

          222KB

          MD5

          88c896180c339f8112c76aaf7aa111bf

          SHA1

          5c9750f9b3f05694a872d0a6a08fd2d17442ae24

          SHA256

          bf2f15445e8d4d0fd4900cf4164618f7c6e3d26a4c4257568c0da1d4124b5124

          SHA512

          553c452f018340eedc30ec1cfb681d06154b3592e04102dee9ecb9c42e2bef55120f3405d5f55200e528def26e08920ca347db7ead5c8824552ec448a340393e

        • memory/1632-27-0x0000000007A70000-0x0000000007B7A000-memory.dmp

          Filesize

          1.0MB

        • memory/1632-22-0x00000000007E0000-0x000000000081E000-memory.dmp

          Filesize

          248KB

        • memory/1632-23-0x0000000007BE0000-0x0000000008184000-memory.dmp

          Filesize

          5.6MB

        • memory/1632-24-0x00000000076D0000-0x0000000007762000-memory.dmp

          Filesize

          584KB

        • memory/1632-25-0x0000000004C50000-0x0000000004C5A000-memory.dmp

          Filesize

          40KB

        • memory/1632-26-0x00000000087B0000-0x0000000008DC8000-memory.dmp

          Filesize

          6.1MB

        • memory/1632-28-0x00000000078C0000-0x00000000078D2000-memory.dmp

          Filesize

          72KB

        • memory/1632-29-0x0000000007930000-0x000000000796C000-memory.dmp

          Filesize

          240KB

        • memory/1632-30-0x0000000007970000-0x00000000079BC000-memory.dmp

          Filesize

          304KB

        • memory/1720-18-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/1720-16-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/1720-15-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

        • memory/1720-14-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB