Overview
overview
10Static
static
315dbe47ffc...c2.exe
windows10-2004-x64
10259d304678...83.exe
windows10-2004-x64
102692caca2a...20.exe
windows10-2004-x64
1028a50ab6e2...10.exe
windows10-2004-x64
104c05a0a402...f4.exe
windows10-2004-x64
105a9aed6661...2d.exe
windows10-2004-x64
105f5fe0dfe7...ca.exe
windows10-2004-x64
106b5a910219...c6.exe
windows10-2004-x64
106d91ecfeed...9b.exe
windows7-x64
106d91ecfeed...9b.exe
windows10-2004-x64
106ffb586f67...d9.exe
windows10-2004-x64
1073c6d3d5d7...90.exe
windows10-2004-x64
1075b625c13b...07.exe
windows10-2004-x64
108a4cf22002...f5.exe
windows7-x64
108a4cf22002...f5.exe
windows10-2004-x64
10aa03da34a3...c3.exe
windows10-2004-x64
10c4259cbbbe...3b.exe
windows10-2004-x64
10c71d93f739...fb.exe
windows10-2004-x64
10c98c961b6f...67.exe
windows10-2004-x64
10d76ee17b4a...b8.exe
windows10-2004-x64
7ec3af3633a...54.exe
windows10-2004-x64
10fbb293bc8b...e5.exe
windows10-2004-x64
10Analysis
-
max time kernel
91s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
15dbe47ffc282036b5b74c9775a05b1985197b01705a5e5240936b02f6f8c2c2.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
259d304678a712b51f1187d33ecd946f12224f4900cad091b3a39900d04e9d83.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
28a50ab6e2f0c1302196528ba89864cb218567116ae9f4a7ff25ad2517acf510.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
4c05a0a402e12dd4248772fa3577f38e1fc9b8b060c219cf8a4890bfce5439f4.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral6
Sample
5a9aed66614843df861e1716ffa1565f310d3f61f384e45ac0468be8b6bc162d.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
6b5a910219dbef3059255fe4700c0b661a248a20051c4624275c60fcb969a4c6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
6d91ecfeedfc048e057ef390c0a9a12a14dd8dadc74b44e7d17e7d767fa6fb9b.exe
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
6d91ecfeedfc048e057ef390c0a9a12a14dd8dadc74b44e7d17e7d767fa6fb9b.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
6ffb586f674fda7588cfb5e9ebac49e43e607069c4c43597e624fc42ac70b8d9.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
73c6d3d5d789b4c1b22119cf829a0a27609d598ad9afb0d622c8abb66982bf90.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
75b625c13b24d7458adfc514723864292401468613eaedafdba252e90b3f5707.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe
Resource
win7-20240221-en
Behavioral task
behavioral15
Sample
8a4cf2200249c16ad339a708d70a7a76427cc48fe52e324e22cb2b14c043a4f5.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
aa03da34a3df5ccd4a8378896e723e73365b3d7713664fcafe751f873108dcc3.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
c4259cbbbeecc45ba6b72e216489e0c0f668de9a18069a255c88f5440350243b.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral18
Sample
c71d93f73909af1aaed89e205cf18f3305701f5725a7f73bc47959ec2fe389fb.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
c98c961b6fafcd423b7f00c273b1de0344bce9a806fb75483a3ed9f8f686a467.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
d76ee17b4a6047aa98a5b0abc7a035b345706ef3087c8b527b238db6e24fdbb8.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
ec3af3633a52750aaf806f34de5b8fb483a77417b0a8182b5cd0f8fe892b0c54.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral22
Sample
fbb293bc8b089d284989e99bec9363092a97e4084b29e5eeb9d9ac35568bb7e5.exe
Resource
win10v2004-20240426-en
General
-
Target
5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe
-
Size
334KB
-
MD5
028bb2836faeb4ed911711bbae9ad27d
-
SHA1
bd16951419c1a78c8e23f0e1666249ca3e50c409
-
SHA256
5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca
-
SHA512
7bf790bc6aaa9663817770a418bc96c7738d4efd2433dcff9c616cb0c37bf42d7db10b4019b510ed2d069cb38374cb2faa2a0bd0b2f3adf5e82b0da1f2adf170
-
SSDEEP
6144:Kby+bnr+4p0yN90QEpQ4eSEo9i3CbxJTUHMh8WZP0g+4+WHSWp3WdnYK:NMr0y90bFeSD9i3YJTUs2Wug+4+wS9j
Malware Config
Signatures
-
Detect Mystic stealer payload 4 IoCs
resource yara_rule behavioral7/memory/3228-7-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral7/memory/3228-11-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral7/memory/3228-8-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family behavioral7/memory/3228-9-0x0000000000400000-0x0000000000433000-memory.dmp mystic_family -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 2 IoCs
pid Process 2624 1qF29QN9.exe 4416 2Sj9142.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2624 set thread context of 3228 2624 1qF29QN9.exe 86 -
Program crash 1 IoCs
pid pid_target Process procid_target 2864 3228 WerFault.exe 86 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2Sj9142.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2Sj9142.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 2Sj9142.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3628 wrote to memory of 2624 3628 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe 82 PID 3628 wrote to memory of 2624 3628 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe 82 PID 3628 wrote to memory of 2624 3628 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe 82 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 2624 wrote to memory of 3228 2624 1qF29QN9.exe 86 PID 3628 wrote to memory of 4416 3628 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe 89 PID 3628 wrote to memory of 4416 3628 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe 89 PID 3628 wrote to memory of 4416 3628 5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe"C:\Users\Admin\AppData\Local\Temp\5f5fe0dfe7abbcda9826593f0816a3b72630e87a3d058a3382b48820dfc0f3ca.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1qF29QN9.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1qF29QN9.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:3228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3228 -s 5484⤵
- Program crash
PID:2864
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Sj9142.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Sj9142.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:4416
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3228 -ip 32281⤵PID:1756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
MD5784667bb96ccb30c4cf44f2c5f493769
SHA128185165ab4dbbb4a139ae1af0bb6934ebe05c04
SHA2561025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9
SHA51262c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b