Edit tour

Windows Analysis Report
https://westmaidentrue.click/mirage/magestique

Overview

General Information

Sample URL:	https://westmaidentrue.click/mirage/magestique
Analysis ID:	1636623
Infos:

Detection

RedLine

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Found direct / indirect Syscall (likely to bypass EDR)

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Found dropped PE file which has not been started or loaded

Queries the volume information (name, serial number etc) of a device

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 4660 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,14732196840622358889,9722313244404987971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1580 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://westmaidentrue.click/mirage/magestique" MD5: E81F54E6C1129887AEA47E7D092680BF)

rundll32.exe (PID: 1560 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

zkwindow.exe (PID: 3832 cmdline: "C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe" MD5: 7700F61BECA60DB53658C52A05B01941)

7zG.exe (PID: 3620 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Downloads\Stars_pack_version_21.3.1\" -spe -an -ai#7zMap13774:114:7zEvent31951 MD5: 50F289DF0C19484E970849AAC4E6F977)

zkwindow.exe (PID: 6020 cmdline: "C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe" MD5: 7700F61BECA60DB53658C52A05B01941)

cmd.exe (PID: 4832 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 1660 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000002.2319472527.00000000056A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2319472527.00000000056A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\7-Zip\7zG.exe

File opened: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll

Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.25:443 -> 192.168.2.17:49740 version: TLS 1.2

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 51.132.193.104
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 52.109.28.46
Source: unknown	TCP traffic detected without corresponding DNS query: 52.123.128.14
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.131
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.186.131
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.60

Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.svc.static.microsoft

Source: global traffic	DNS traffic detected: DNS query: westmaidentrue.click
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.76:443 -> 192.168.2.17:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.86.251.25:443 -> 192.168.2.17:49740 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir4660_2138186876

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir4660_2138186876

Source: classification engine

Classification label: mal60.troj.evad.win@32/14@4/102

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\d5d6b308-bfbb-4dd4-bf8b-ff8f825d0b61.tmp

Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe

File created: C:\Users\user\AppData\Local\Temp\c149800b

Source: C:\Windows\SysWOW64\cmd.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,14732196840622358889,9722313244404987971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1580 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://westmaidentrue.click/mirage/magestique"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1960,i,14732196840622358889,9722313244404987971,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1580 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe "C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe"
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Downloads\Stars_pack_version_21.3.1\" -spe -an -ai#7zMap13774:114:7zEvent31951
Source: unknown	Process created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe "C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe"
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe	Section loaded: qtcore4.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe	Section loaded: qtgui4.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe	Section loaded: qtnetwork4.dll
Source: C:\Users\user\AppData\Local\Temp\Temp1_Stars_pack_version_21.3.1.zip\version_21\zkwindow.exe	Section loaded: comn.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: explorerframe.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textshaping.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textinputframework.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coreuicomponents.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: qtcore4.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: qtgui4.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: qtnetwork4.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: comn.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: winmm.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: libssl-1_1.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: userenv.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: libcrypto-1_1.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: netutils.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: samcli.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: pla.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: pdh.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: tdh.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: cabinet.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: wevtapi.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: shdocvw.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: winbrand.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: linkinfo.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntshrui.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cscapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bitsproxy.dll

Source: C:\Program Files\7-Zip\7zG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\7-Zip\7zG.exe

File opened: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll

Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcp80.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\Comn.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtCore4.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtGui4.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libssl-1_1.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtNetwork4.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll	Jump to dropped file

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	API/Special instruction interceptor: Address: 6CB27C44
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	API/Special instruction interceptor: Address: 6CB27945
Source: C:\Windows\SysWOW64\cmd.exe	API/Special instruction interceptor: Address: 6CB23B54

Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcp80.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libssl-1_1.dll	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	Dropped PE file which has not been started: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll	Jump to dropped file

Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe

Process information queried: ProcessInformation

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	NtProtectVirtualMemory: Direct from: 0x77DF7B2E
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	NtQueryInformationToken: Direct from: 0x6500399D
Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	NtSetSecurityObject: Direct from: 0x77DF63E1

Maps a DLL or memory area into another process

Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe

Section loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write

Source: C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match

File source: 00000013.00000002.2319472527.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: Yara match

File source: 00000013.00000002.2319472527.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match

File source: 00000013.00000002.2319472527.00000000056A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	111 Process Injection	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Rundll32	NTDS	111 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner	Label	Link
https://westmaidentrue.click/mirage/magestique	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\Comn.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtCore4.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtGui4.dll	11%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtNetwork4.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcp80.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll	0%	ReversingLabs
C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xml	0%	Avira URL Cloud	safe
https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xml	0%	Avira URL Cloud	safe
https://otelrules.svc.static.microsoft/rules/rule701100v1s19.xml	0%	Avira URL Cloud	safe
https://otelrules.svc.static.microsoft/rules/rule701101v1s19.xml	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
westmaidentrue.click	104.21.16.1	true	false		unknown
www.google.com	142.250.181.228	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xml	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule701100v1s19.xml	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xml	false	Avira URL Cloud: safe	unknown
https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml	false		high
https://otelrules.svc.static.microsoft/rules/rule701101v1s19.xml	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.99	unknown	United States	15169	GOOGLEUS	false
142.250.110.84	unknown	United States	15169	GOOGLEUS	false
142.250.181.238	unknown	United States	15169	GOOGLEUS	false
104.21.16.1	westmaidentrue.click	United States	13335	CLOUDFLARENETUS	false
142.250.185.206	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.181.228	www.google.com	United States	15169	GOOGLEUS	false
142.250.186.142	unknown	United States	15169	GOOGLEUS	false
142.250.184.227	unknown	United States	15169	GOOGLEUS	false
216.58.212.163	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1636623
Start date and time:	2025-03-13 00:54:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://westmaidentrue.click/mirage/magestique
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.troj.evad.win@32/14@4/102

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.186.142, 142.250.185.206, 142.250.110.84
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, clientservices.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
VT rate limit hit for: https://westmaidentrue.click/mirage/magestique

Created / dropped Files

C:\Users\user\AppData\Local\Temp\c149800b

Download File

Process:	C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe
File Type:	data
Category:	dropped
Size (bytes):	1573670
Entropy (8bit):	7.7267050576046
Encrypted:	false
SSDEEP:
MD5:	FE456788132917CE89DC14974A4EEBE1
SHA1:	8F73A042EC8F996273E1F351D219055FF161D397
SHA-256:	DF12CB39E129E6E4BC8711D1CF78CCE05B99D5A2137B3C9B24BAD0A53682754A
SHA-512:	2DD3313982317E0C008BBA0E121B55521ADED3B94A79B756780B1A5DF5724458642F5C327B6F3D526FC6CEB65B8D2C9C4E1201AB236E56A1B3CF342DD0740696
Malicious:	false
Reputation:	unknown
Preview:	.X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..............*...>...1.../...,...x...-...7...5...,...-..X..X..X..X..X..X..X..X..X..X..X...7...,...1... ..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X...7...9...6...6...X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..............7...,.......9...7...X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X..X...j..m..o..X..X..X..X..X..X..X..X..X..X..

C:\Users\user\Downloads\Stars_pack_version_21.3.1.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	AA29FF8DCBFB8156EBA033E28F03A04F
SHA1:	1453014278C8891FCE9685C0A6BD4D079A763C24
SHA-256:	1A34C9B4500CF7859C36C102209902202FB7188ACA1BA759F2D5018BF2655CC1
SHA-512:	14A8EFC38A3DD0215B5B9587C80740681E0464F075EE777389E9458411590CF3CDD3EB0A7EF328EFFEA5AE0DDC6E6AF20266ED88717743CD46B364E0736C3EEF
Malicious:	false
Reputation:	unknown
Preview:	PK.........AlZ................version_21/PK........1AlZ...9....>Q......version_21/acajou.dmgT[...U.?...H.`..01.lX....{.w.T..H..."\.5D..(......QNL4)..>%%......]..{.7......c8..\|.k....X.1{.5..g>.I....mg~.x#.....X.....R..P.[..X..{I.a,.......~..f.:.....g5..G+jM........eZc...X'.y....#e......(...1'...I.^./.B.'..2. ..V. .........+3..Z...iMJ...t.K.z....a.B.+.:f.ZCY.c&...{B.#..!..X.me>.#.:....~..A!m2.<.p...%..>.....:.....Mc.. .x.....j...I.W.k..Y.....2.C.k..X~@(.!.7...i..... `bO...o.F'..F.9.GN...(A..)K.....I@.,\|N..R.Gc@.....".C\|...N.T6.J.a.X..S..b....6..c...!...7.%...Z..rvV.Rs%..=..'T=.%C..Ju4..X1.+.0....$l..&..Y.C.Za.n.9#..m...Y...."R?.$VZ.w.... ..rE..jK6.-....V..1Q.....H..V...9b.J.f.h.........eE%..8.KUhGhJ...f......ki.U\..:.]f..}.. ..D..{......:..,.......'.x..:~..Y!f....@..8<:..s8...n.........Z...gX8...8.A.....'.4=f6\|....`I%S.R.:c.sB.#.....F).?.....6...H.........J.E....mVt..I.c1Z_.H..g!U....>8........a...."..5.\...~.../Y........'.q.X....}.Zbv..p..h.!?Yb..

C:\Users\user\Downloads\Stars_pack_version_21.3.1.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	7905506
Entropy (8bit):	7.9967988625890225
Encrypted:	true
SSDEEP:
MD5:	AA29FF8DCBFB8156EBA033E28F03A04F
SHA1:	1453014278C8891FCE9685C0A6BD4D079A763C24
SHA-256:	1A34C9B4500CF7859C36C102209902202FB7188ACA1BA759F2D5018BF2655CC1
SHA-512:	14A8EFC38A3DD0215B5B9587C80740681E0464F075EE777389E9458411590CF3CDD3EB0A7EF328EFFEA5AE0DDC6E6AF20266ED88717743CD46B364E0736C3EEF
Malicious:	false
Reputation:	unknown
Preview:	PK.........AlZ................version_21/PK........1AlZ...9....>Q......version_21/acajou.dmgT[...U.?...H.`..01.lX....{.w.T..H..."\.5D..(......QNL4)..>%%......]..{.7......c8..\|.k....X.1{.5..g>.I....mg~.x#.....X.....R..P.[..X..{I.a,.......~..f.:.....g5..G+jM........eZc...X'.y....#e......(...1'...I.^./.B.'..2. ..V. .........+3..Z...iMJ...t.K.z....a.B.+.:f.ZCY.c&...{B.#..!..X.me>.#.:....~..A!m2.<.p...%..>.....:.....Mc.. .x.....j...I.W.k..Y.....2.C.k..X~@(.!.7...i..... `bO...o.F'..F.9.GN...(A..)K.....I@.,\|N..R.Gc@.....".C\|...N.T6.J.a.X..S..b....6..c...!...7.%...Z..rvV.Rs%..=..'T=.%C..Ju4..X1.+.0....$l..&..Y.C.Za.n.9#..m...Y...."R?.$VZ.w.... ..rE..jK6.-....V..1Q.....H..V...9b.J.f.h.........eE%..8.KUhGhJ...f......ki.U\..:.]f..}.. ..D..{......:..,.......'.x..:~..Y!f....@..8<:..s8...n.........Z...gX8...8.A.....'.4=f6\|....`I%S.R.:c.sB.#.....F).?.....6...H.........J.E....mVt..I.c1Z_.H..g!U....>8........a...."..5.\...~.../Y........'.q.X....}.Zbv..p..h.!?Yb..

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\Comn.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	357824
Entropy (8bit):	6.480962458661732
Encrypted:	false
SSDEEP:
MD5:	F76F5A566CBB5F561D26E7ACA841C723
SHA1:	4838FD2DD9DBFCDAF2B1F11091F15A17F93C29BE
SHA-256:	0576FC3B0C9381C47A8A9443ABDD195EEBB34ECE0ADC5C6D17624CA0E914E8E3
SHA-512:	9F574F09A4C54B8E786846297FCFAD7AF647EB134D8E960B078A83E982CCAE2956AA6C4C1014C01C7774461E31314904CB6DFC325C7A90C3E31130838BEB24C0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#..B...B...B..$..B.....B.......B.......B.....B...B...C...a...B.....B.....B.....B..Rich.B..................PE..L.....Rc...........!.....p..........,........................................0..........................................[...d...,.................... ...U......t1...................................W..@............................................text...ae.......p.................. ..`.rdata...=.......@..................@..@.data...............................@....rsrc...............................@..@.reloc...6.......@..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtCore4.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2417832
Entropy (8bit):	6.575514790038478
Encrypted:	false
SSDEEP:
MD5:	03985B7B207E63B6BB894EA6EA78D92B
SHA1:	0E6FC44B1F3C724E6050152D9E240A548314A6FF
SHA-256:	793153A9262E4C280A71EA595FE49208A89766D6D344766AF0ABF8C32648F3E0
SHA-512:	A2E9749C7D7C9745EB16B6976C6C208B3CE2EE524E958CF7C41D0D31A7FB761C4F66AD8320301C652EF4EA8128111AD9687E64F3944D40B933153D99AB8C272B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........AP...P...P....L..R...wN..Z...wN..T.......R.......[...P...B...wN..q...wN.....wN..Q...wN..Q...wN..Q...RichP...........................PE..L...'W.P...........!.....@...P.......H.......P.....g..............F...........$.......%.............................p$..N(............#...............$..D....#.<...................................x...@............P..P............................text....5.......@.................. ..`.rdata.......P.......P..............@..@.data...D+...P#..0...P#.............@....rsrc.........#.......#.............@..@.reloc..p.....#.......#.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtGui4.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8602792
Entropy (8bit):	6.7150598637405245
Encrypted:	false
SSDEEP:
MD5:	4346A780699F377A189A38247A0D513A
SHA1:	5D5AA81A6CA07862A8A7E48D592CDA6377C1AA60
SHA-256:	DBDF5E11EC81ED1D941EC16FC7B94AB65F814CEB1E7FB524F2C64CBB422F7382
SHA-512:	C8A7B3DDFC856510334B7BA382B5DBAAC08E9E7EF4A1209ABFB2AA21F5C5A54DF5390F2145FA1D3C1E4E5A2983A692A133D9D219D0AE9FD0870C52AC414F317C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......TEg..$...$...$...w..$..7.t..$...+V..$..7.r..$...+T..$...$..d#..7.d..$..7.g..%..7.s..$..7.u..$..7.q..$..Rich.$..........PE..L....Y.P...........!.....@Y...)......RQ......PY....e..............F..........@......................................`.n.....`.m.,....@\|..................D...P\|..k..................................htd.@............PY..............................text....=Y......@Y................. ..`.rdata...."..PY.. "..PY.............@..@.data........p{......p{.............@....rsrc........@\|.......\|.............@..@.reloc..8....P\|.......\|.............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtNetwork4.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	844968
Entropy (8bit):	6.4745607519760995
Encrypted:	false
SSDEEP:
MD5:	A3C0C0B1442CDC0A2F49C2B2AE39D245
SHA1:	6AFF3D64E06955FB9AD4B19C394DCFDC212B423A
SHA-256:	901FC44992636086F2BC958AA3BDBE2D9AC3E169FC11E0F9D92D235CC906A35A
SHA-512:	B4BB0196AB8A960206B7F1D082EB7D94A408345A2887694D17186F3A2581E9263DDD43D099F2493EE8789AB5EBABAC911BA54C069E517CFC479461B1A7BB4F20
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......F.t.............$d.....%&w.....%&g.....%&a...............G.....%&t.R...%&`.....%&f.....%&b.....Rich....................PE..L...4L.X...........!......................... .....d..............F.................i&..............................@.......$9..d........................D......D.......................................@............ ...............................text............................... ..`.rdata..:a... ...p... ..............@..@.data....7....... ..................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\acajou.dmg

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	Matlab v4 mat-file (little endian) l, numeric, rows 20557, columns 7301632
Category:	dropped
Size (bytes):	1331518
Entropy (8bit):	7.955151872319542
Encrypted:	false
SSDEEP:
MD5:	FFE5B815B53AEFA2A3F9841B769E81CF
SHA1:	7CA12C0A136835C659F3DAFF0E6ECEAB396F45E2
SHA-256:	881E7EF68C2A1BCFBDC5ED6F487964B5DE35D0D089EFC070392695012E9D25D0
SHA-512:	DCB9AC756428D05B06B589158FAE4A7C5396ACB54F739FC21866E77DCB475E35F4650954F29A8792BC957FC6DD0D5100852C85C791860637ECDBF3A3452CF2B8
Malicious:	false
Reputation:	unknown
Preview:	....MP...jo......CcGl..a..OZ.r.a....OV.\b.m...v.SO.W...U\.....S.....b.qI.M..lQfZ.....Als.w..Y.Wwa.u..g.K.o.C.U.XW....S.mC.op.Yi`.kW.oR.h]mCDX.I..[w.BTU.EI]NTFB.u^.vh.w\lU.Tfe..dI.T..]......U..Q.y.n.T..kfmwbxfgZ..b^Av.OyYZem.y\.q.o.ob..gwq.l.UT.T...oE.EJA.c.....u....fEbw.t.x.qL..v..MPip.U.vMZe.^.JRN..dTZ.U.......X...M.s.XSM.VDPZ.ucnB..[X..i..yicJJ.h.h....t...Ok..PV...........X...[bCdh..[E.K..h....^P.`..Y.._tS.Qy...v.n_..lFf.....ivMnI.tI.qm.sM....M.db..mU...W..d....b.......Sk..]X.....j..............aE....X...K.T^..g....d.nNg...Y^d..ZQ..c...otqTA.XWvJe...j.c.f....r..Y.iL..W..H.....BG..o_..Q^.J..Zl.S.GZ.t...q.ScZBN.Q.Gu.a^q..g.C.g.R..wR...R..r.x..........JH\.S..h.I..SfPo....ox.wgO.nY..R.A.G.vOh.s.`Bw.....dc....^.po..iw.j^.....Y._.....K...`NY...kfLl.\u.M..m.av[.Q\.xerb.X..e.R...y.B..._..Gf.f....j[v.Rl...k..V.gjMUMNar.Nb\...BG..CBl...n.u..Zq.yX.wLf...BoiL...[...d.w...o..ILEl.Vtl...S`..b.N].jA.Ny.Y.._.RBit\...jgO.sC.y.y....\.T..Soc.i._A\..FVO]......L....Vv..XI.H.n.....n\....S.gDt.J.ZW.[.k.hBW

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libcrypto-1_1.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2344104
Entropy (8bit):	6.164986869226677
Encrypted:	false
SSDEEP:
MD5:	832205883448AB8C689D8A434D92F80B
SHA1:	890C403A288C65683EDBE9917B972CEB6EB7EBA7
SHA-256:	558ADDAE67D50612ACD60A02FB29D41BE61999D299348DF9A225E419CC9395ED
SHA-512:	0C1B8B3776C14B78F9B7AC09627CA7762F62C63DA489204F376519752B029951798C1ED24AED07CC660C5E54936C06560FDA921E33A76E80EBAB10EF97177973
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L....k...k...k../...$k../....k...k...k...d...k../....h../....k../....k../....k..Rich.k..................PE..L.....+_...........!................aC........................................#.......#.............................`....f....".d.....".\|.............#..D....".h...@............................... ...@............".t............................text...P........................... ..`.rdata..fK.......P..................@..@.data....y... "..0... ".............@....idata........".. ...P".............@....rsrc...\|....."......p".............@..@.reloc........".......".............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libssl-1_1.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	656552
Entropy (8bit):	5.884693907932688
Encrypted:	false
SSDEEP:
MD5:	CDBF8CD36924FFB81B19487746F7F18E
SHA1:	781190C5A979359054CE56CEEF714A8F5384CFBB
SHA-256:	0813C77DF688B39F26BAD0BE2B3E4AFDE13E97D9A1EBCBDB3B1F4184218D1A57
SHA-512:	CA43450E853B3C74808AD199ABE329AC2A2D7AE2E84C17FB467374C22EC9620FB102C75889E279E2D28F0EBD14D8BAFAFE700241BA4141FD64B4801802A3D474
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........p...#...#...#..#...#...#...#...#...#...#...#...#...#...#Q..#...#...#...#...#...#...#Rich...#................PE..L.....+_...........!..... ...................0.......................................1...............................p...N...0..<.......s................D......,@..@;.............................. W..@...........T:...............................text............ .................. ..`.rdata.......0.......0..............@..@.data...Xi.......P..................@....idata...A...0...P..................@....rsrc...s............`..............@..@.reloc...H.......P...p..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\mickey.db

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	data
Category:	dropped
Size (bytes):	44051
Entropy (8bit):	4.766333590198286
Encrypted:	false
SSDEEP:
MD5:	09EC1026D8E37966569B4E0E342085FD
SHA1:	A5478A19E3C258CA1FC58E5C9E8CCA8181FE103E
SHA-256:	DD024320B537CDD9D2604BA6FE6B1D1B25856B03F65F791B646BA0DC5A8DCD78
SHA-512:	A71756B2FDBF1D588932484D442B8D0E1A0A6D979163058BCDB7F31837E9816C3C2C79FBF8A6C54446ACB00350A69F7064AFAFA7C44169A98C6A564E036147F2
Malicious:	false
Reputation:	unknown
Preview:	J..A.i......O...L]..o..O.^RyvZlnp.lsi.Dd...x[P.....w...EQ.o...^.y...B.V.L.KJ.h..c..r..x...q..[a^..K..Nc.C.e.s.qL......M.q.bB....CMYnbZ..Y.q.p...I.M...Yjg.A.Hge.E....\o..t....cw.^J\....ia.._x.FSk..i.._b.Mg..Y....KP.u..F.J.W.tYl..k...R.Q.On.k....m.N.M.Dx.wt.qY..M..eV.....eS...IQ..JO.MYu..[..[...VmAb....MF..FT...Y.mXY.RJ.rt.y.u....mTf...r...m..Jg...J\ne.G...TOE.p.y..r......]y...wJK.g.[..a..v_..e..CodWB..K..Vvi.t...HS.I...F.^.Nh.TZ[dS........jcf..b........^IF.....^tOv......\.d.m.\.JwL.wO...Fg.H......v...xXH.Xy....ukn....L.P..X]j.l..i..q.SJ..y.sk.jL.^..ARj.j.vSDky.q..D..vV.hk.HC..uu..q...`S.W...C..F.H.\sZ.t.TS...Q.ifM...lMLb..ju...sl..AmsM.RV..P.a..xr.dw\N.H.._p...Ex..auXb.^....mvC..T..NY..s...G..SMmo...TO.ey........X\...J....b.\.o..]aR_..qYn...E..w..\.h...UBHDN.eWgI.IQ....BJPf..RpDj^ee^.Fa.[....RK.P..P.DW.mP.M..^iSd...e...D.nO..L.C..p..n......TW..qrOp.Q...L.Mw..Ky..y.......f..^V].au....Gry.....c..._..fiG\.....F..p.OaZebZH.L..Pl...fg.jtsU[.j....Hh\._sF...G...X...lu.c....\WW.]VLh.uHw..Oh....

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcp80.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	548864
Entropy (8bit):	6.404927820299697
Encrypted:	false
SSDEEP:
MD5:	272A9E637ADCAF30B34EA184F4852836
SHA1:	6DE8A52A565F813F8AC7362E0C8BA334B680F8F8
SHA-256:	35B15B78C31111DB4FA11D9C9CAD3A6F22C92DAA5E6F069DC455E72073266CC4
SHA-512:	F1F04A84D25A74BB1CF6285EF705F092A08E93D39DF569F6BADC45B8722D496BBBEF02B4E19F76A0332E3842945506C2C12AD61FE34F339BB91F49B8D112CD52
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L....^j[...........!.....@... ...............P....B\|.........................p............@.............................L...T...<............................ ..H2...S..............................Pe..@............P.. ............................text...V>.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	626688
Entropy (8bit):	6.840096566307411
Encrypted:	false
SSDEEP:
MD5:	43143ABB001D4211FAB627C136124A44
SHA1:	EDB99760AE04BFE68AAACF34EB0287A3C10EC885
SHA-256:	CB8928FF2FAF2921B1EDDC267DCE1BB64E6FEE4D15B68CD32588E0F3BE116B03
SHA-512:	CED96CA5D1E2573DBF21875CF98A8FCB86B5BCDCA4C041680A9CB87374378E04835F02AB569D5243608C68FEB2E9B30FFE39FEB598F5081261A57D1CE97556A6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...I^j[...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`.......................p..P3...B...............................F..@............@...............................text....'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	349640
Entropy (8bit):	4.941036201296748
Encrypted:	false
SSDEEP:
MD5:	7700F61BECA60DB53658C52A05B01941
SHA1:	983F920FFEC60B308C02CC07E0ABF465C8BA965A
SHA-256:	7E6B2664F4417F5A8F981CED5F2EEF867CB72BCA990FE3864D76D878FF62CF52
SHA-512:	33E68F2B2440079A75523F69D55EBEB175F1448731D28BA1A120729DF3E1612231903C5A9872AB673D629E865F60550BEC52D7004417F0305E412724DC8011D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........p....k...k...k.%.....k.......k.......k.......k...j...k.......k.......k.Rich..k.................PE..L......c................. ..........s .......0....@.................................<g...................................................................U..............................................@............0...............................text...k........ .................. ..`.rdata.......0.......0..............@..@.data...8...........................@....rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\d5d6b308-bfbb-4dd4-bf8b-ff8f825d0b61.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	5467
Entropy (8bit):	7.931692789289847
Encrypted:	false
SSDEEP:
MD5:	20DBDA147132B510BC9F05980E014135
SHA1:	76645CD414FD5537FA7B99F1ADF932C931E02C35
SHA-256:	815359E2A1F07CAFDE6F5B986320EF87CC84627499817C5FBF210A74727751B0
SHA-512:	D7F321572AFF27A2BD1555698F09A591A073E37BA19181A4B7B181468519E41E9EE57789FECFA18466CD3E0361DA1288B97D22BC6F3B1395FCB9232B1D4F26B3
Malicious:	false
Reputation:	unknown
Preview:	PK.........AlZ................version_21/PK........1AlZ...9....>Q......version_21/acajou.dmgT[...U.?...H.`..01.lX....{.w.T..H..."\.5D..(......QNL4)..>%%......]..{.7......c8..\|.k....X.1{.5..g>.I....mg~.x#.....X.....R..P.[..X..{I.a,.......~..f.:.....g5..G+jM........eZc...X'.y....#e......(...1'...I.^./.B.'..2. ..V. .........+3..Z...iMJ...t.K.z....a.B.+.:f.ZCY.c&...{B.#..!..X.me>.#.:....~..A!m2.<.p...%..>.....:.....Mc.. .x.....j...I.W.k..Y.....2.C.k..X~@(.!.7...i..... `bO...o.F'..F.9.GN...(A..)K.....I@.,\|N..R.Gc@.....".C\|...N.T6.J.a.X..S..b....6..c...!...7.%...Z..rvV.Rs%..=..'T=.%C..Ju4..X1.+.0....$l..&..Y.C.Za.n.9#..m...Y...."R?.$VZ.w.... ..rE..jK6.-....V..1Q.....H..V...9b.J.f.h.........eE%..8.KUhGhJ...f......ki.U\..:.]f..}.. ..D..{......:..,.......'.x..:~..Y!f....@..8<:..s8...n.........Z...gX8...8.A.....'.4=f6\|....`I%S.R.:c.sB.#.....F).?.....6...H.........J.E....mVt..I.c1Z_.H..g!U....>8........a...."..5.\...~.../Y........'.q.X....}.Zbv..p..h.!?Yb..

Static File Info

⊘No static file info

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://westmaidentrue.click/mirage/magestique

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Local\Temp\c149800b

C:\Users\user\Downloads\Stars_pack_version_21.3.1.zip (copy)

C:\Users\user\Downloads\Stars_pack_version_21.3.1.zip.crdownload

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\Comn.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtCore4.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtGui4.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtNetwork4.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\acajou.dmg

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libcrypto-1_1.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libssl-1_1.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\mickey.db

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcp80.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe

C:\Users\user\Downloads\d5d6b308-bfbb-4dd4-bf8b-ff8f825d0b61.tmp

Static File Info

Windows Analysis Report
https://westmaidentrue.click/mirage/magestique