Overview
overview
10Static
static
33f631a363d...63.exe
windows10-2004-x64
10498a26c182...6f.exe
windows10-2004-x64
104b34c552db...dd.exe
windows10-2004-x64
10532834d8ce...8e.exe
windows10-2004-x64
105896992807...ed.exe
windows10-2004-x64
1059c0083cd8...df.exe
windows10-2004-x64
106fc46cbdbb...5c.exe
windows7-x64
106fc46cbdbb...5c.exe
windows10-2004-x64
108433f5b093...73.exe
windows7-x64
108433f5b093...73.exe
windows10-2004-x64
1086d4877bad...f4.exe
windows10-2004-x64
109b49de72ab...8f.exe
windows10-2004-x64
10b05d662dcb...df.exe
windows10-2004-x64
10b84e93b222...f7.exe
windows10-2004-x64
10bee0ec9430...1b.exe
windows10-2004-x64
10c95a5553b1...1a.exe
windows10-2004-x64
10ca54f6dfd1...d5.exe
windows10-2004-x64
10cca7f7e048...56.exe
windows10-2004-x64
10cf9a62d5a1...b4.exe
windows10-2004-x64
10d211b73bae...c6.exe
windows10-2004-x64
10eb23946a76...29.exe
windows10-2004-x64
7f2301f9ee1...18.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 08:22
Static task
static1
Behavioral task
behavioral1
Sample
3f631a363d36dce5c91238bcde6bb465721778887e036ad1016b185a4b4f9a63.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
498a26c182a4f66822f65140c2f38df8b9da8ced42ed08651892aa416b8e3b6f.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
4b34c552dbab5efc9560efa54f934de7c83ac3d7a313df811145ebfadf64c2dd.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
532834d8ce7000d8e7eb38c91e27411e3b18295ef7db64dc83c3982ac0a9ae8e.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
5896992807f979d7483ac37e3ec58f2b7816d71d0c0cc96def5c78ddb0301ded.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
59c0083cd89906e6947197abc27233f2d2fdeb0cc852b57cd3a6e42063bc2adf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
6fc46cbdbb6e435050e052f67ee83426ac1f65c26e34bc81e339bbb10d07a55c.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
6fc46cbdbb6e435050e052f67ee83426ac1f65c26e34bc81e339bbb10d07a55c.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
8433f5b093e4f920b53f3456df2f996e8f480ad451bdcdc88ebaddda4abd8a73.exe
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
8433f5b093e4f920b53f3456df2f996e8f480ad451bdcdc88ebaddda4abd8a73.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
86d4877badbdcb1c02fdb785b5cb78ec9c4f17f7845781fd0b7513dbfb2bbff4.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
9b49de72ab9ae9caaaf0da01fbe6d5bef6546c46b1e0c0b4c4c3f211eaec728f.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
b05d662dcb605a8af070c2bd5fadda687e65adad15dca9ac32982db6ebd36bdf.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
bee0ec94302af9baabb3e2b4d22397424e0fa315031f65258b35135c92ff0b1b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
ca54f6dfd1d165cc099fcff983a1e0d5045ab7589a3cefbb07c34deaf08e0dd5.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
cca7f7e048cad1d80a1eeb878d27b78386889bd305ac5dd66bcf6ab8499b2256.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
cf9a62d5a117aaa03d348685a49a3a176c6dd3ef98e68cdcecaabe67cee3aab4.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
d211b73bae9760b12d1e027c009a4d8f4dbdb34ba630703d65ca56fc612e45c6.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
eb23946a76bf1590eafdacfb8f44604c986536b0b24a3b11f0aa7f8eb4722829.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
f2301f9ee1f258528e83f30f1d7ea7bb59faa2f5d97139ddf14e0b5a805cd018.exe
Resource
win10v2004-20240426-en
General
-
Target
c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe
-
Size
640KB
-
MD5
0914224943c0087d896a2876e94b3e00
-
SHA1
573868ff775ff39ff79890046182780d019a48f0
-
SHA256
c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a
-
SHA512
921e8b46afa64aa5fe07ec47125ec273ef7722c1ecf796593e0c6cbb527690ebab86eb5849d6a86a4f5a010faa01166c4e8a248805c75d6d22a633f9909e8f9a
-
SSDEEP
12288:pMroy90uz5t7W35T0tDyS1uuYB0fJr2NcoP4G8g4PGUijAXhp4ey:1y5XKR0xySJbxxox8gZdEx1y
Malware Config
Extracted
redline
lutyr
77.91.124.55:19071
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral16/memory/1720-14-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral16/memory/1720-15-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral16/memory/1720-18-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral16/memory/1720-16-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2bZ911RA.exe family_redline behavioral16/memory/1632-22-0x00000000007E0000-0x000000000081E000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
xD6jR1ic.exe1nd48qY3.exe2bZ911RA.exepid process 776 xD6jR1ic.exe 3200 1nd48qY3.exe 1632 2bZ911RA.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exexD6jR1ic.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" xD6jR1ic.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1nd48qY3.exedescription pid process target process PID 3200 set thread context of 1720 3200 1nd48qY3.exe AppLaunch.exe -
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1388 3200 WerFault.exe 1nd48qY3.exe 1268 1720 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exexD6jR1ic.exe1nd48qY3.exedescription pid process target process PID 1028 wrote to memory of 776 1028 c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe xD6jR1ic.exe PID 1028 wrote to memory of 776 1028 c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe xD6jR1ic.exe PID 1028 wrote to memory of 776 1028 c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe xD6jR1ic.exe PID 776 wrote to memory of 3200 776 xD6jR1ic.exe 1nd48qY3.exe PID 776 wrote to memory of 3200 776 xD6jR1ic.exe 1nd48qY3.exe PID 776 wrote to memory of 3200 776 xD6jR1ic.exe 1nd48qY3.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 3200 wrote to memory of 1720 3200 1nd48qY3.exe AppLaunch.exe PID 776 wrote to memory of 1632 776 xD6jR1ic.exe 2bZ911RA.exe PID 776 wrote to memory of 1632 776 xD6jR1ic.exe 2bZ911RA.exe PID 776 wrote to memory of 1632 776 xD6jR1ic.exe 2bZ911RA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe"C:\Users\Admin\AppData\Local\Temp\c95a5553b1a709f22bba8f3f68e6c4c0eef94f99fcf143faebfb68ead35a0f1a.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xD6jR1ic.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xD6jR1ic.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nd48qY3.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1nd48qY3.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵PID:1720
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 5405⤵
- Program crash
PID:1268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3200 -s 6004⤵
- Program crash
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2bZ911RA.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2bZ911RA.exe3⤵
- Executes dropped EXE
PID:1632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3200 -ip 32001⤵PID:3740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1720 -ip 17201⤵PID:1344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444KB
MD5e3db7fd4d794951a329eea4121f63d6f
SHA19e1515d34b94d945b9882722f0ac666d22749e3f
SHA2561cccca47a3022f3b233e9e1fb3122f73a400ef2938e6e2cf06b47a57c1500ba9
SHA512ceb23264d453e4f594d29fd7a97c3b4ccfbb50be11f8828ad1df629a8909c6d94e4b4e49c224427f593330209d04d9999fa546e0dd7473796b8cf052fbd61eaa
-
Filesize
422KB
MD50280ebe4f42da1d8476c98e3bb79795a
SHA12a86fde390205c7ea6c0a515e639a6423d929b9f
SHA256e7e11bc18307b19f8ad86ae301759b08bd9886683c24af76e3ba993feea1792f
SHA51227fcff90c7c16554ab2b453ae4c73204b6ac716ddb8065d5004a49b8a57fd3096efef9f2190b69bdc92c7bd4efed88e785dc5ca605f693bd527c7f60573cabb0
-
Filesize
222KB
MD588c896180c339f8112c76aaf7aa111bf
SHA15c9750f9b3f05694a872d0a6a08fd2d17442ae24
SHA256bf2f15445e8d4d0fd4900cf4164618f7c6e3d26a4c4257568c0da1d4124b5124
SHA512553c452f018340eedc30ec1cfb681d06154b3592e04102dee9ecb9c42e2bef55120f3405d5f55200e528def26e08920ca347db7ead5c8824552ec448a340393e