Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\Comn.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtCore4.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtGui4.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\QtNetwork4.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libcrypto-1_1.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\libssl-1_1.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcp80.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\msvcr80.dll

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\zkwindow.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\c149800b

data

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1.zip (copy)

Zip archive data, at least v2.0 to extract, compression method=store

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1.zip.crdownload

Zip archive data, at least v2.0 to extract, compression method=store

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\acajou.dmg

Matlab v4 mat-file (little endian) l, numeric, rows 20557, columns 7301632

dropped

C:\Users\user\Downloads\Stars_pack_version_21.3.1\version_21\mickey.db

data

dropped

C:\Users\user\Downloads\d5d6b308-bfbb-4dd4-bf8b-ff8f825d0b61.tmp

Zip archive data, at least v2.0 to extract, compression method=store

dropped

There are 6 hidden files, click here to show them.

URLs

Name

Malicious

https://westmaidentrue.click/mirage/magestique

Details

Filetype:	URL
Filename:	https://westmaidentrue.click/mirage/magestique

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Found direct / indirect Syscall (likely to bypass EDR)	HIPS / PFW / Operating System Protection Evasion	Abuse Elevation Control Mechanism
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	Security Software Discovery System Information Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Creates files inside the system directory	System Summary	Masquerading
Deletes files inside the Windows folder	System Summary	File Deletion
Drops PE files	Persistence and Installation Behavior
Found dropped PE file which has not been started or loaded	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Yara detected Credential Stealer	Stealing of Sensitive Information
Classification label	System Summary
Connects to IPs without corresponding DNS lookups	Networking
Creates files inside the user directory	System Summary
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
Downloads files from webservers via HTTP	Networking	Ingress Tool Transfer Non-Application Layer Protocol
Performs DNS lookups	Networking
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Runs a DLL by calling functions	System Summary	Rundll32
Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox
Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior
Spawns processes	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses HTTPS	Networking	Encrypted Channel Application Layer Protocol
Uses an in-process (OLE) Automation server	System Summary
Uses new MSVCR Dlls	Compliance, System Summary
Uses secure TLS version for HTTPS connections	Compliance, Networking
Found graphical window changes (likely an installer)	System Summary

https://otelrules.svc.static.microsoft/rules/rule702450v1s19.xml

13.107.246.76

https://otelrules.svc.static.microsoft/rules/rule701100v1s19.xml

13.107.246.76

https://otelrules.svc.static.microsoft/rules/rule120128v0s19.xml

13.107.246.76

https://otelrules.svc.static.microsoft/rules/rule120603v8s19.xml

13.107.246.76

https://otelrules.svc.static.microsoft/rules/rule701101v1s19.xml

13.107.246.76

Domains

Name

Malicious

westmaidentrue.click

104.21.16.1

Details

Name:	westmaidentrue.click
IP:	104.21.16.1
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection

www.google.com

142.250.181.228

Details

Name:	www.google.com
IP:	142.250.181.228
TargetID:	1
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

142.250.185.99

unknown

United States

142.250.110.84

unknown

United States

142.250.181.238

unknown

United States

104.21.16.1

westmaidentrue.click

United States

142.250.185.206

unknown

United States

1.1.1.1

unknown

Australia

142.250.181.228

www.google.com

United States

192.168.2.17

unknown

142.250.186.142

unknown

United States

142.250.184.227

unknown

United States

216.58.212.163

unknown

United States

There are 1 hidden IPs, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
https://westmaidentrue.click/mirage/magestique

Files

URLs

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporthttps://westmaidentrue.click/mirage/magestique

Files

URLs

Domains

IPs

IOC Report
https://westmaidentrue.click/mirage/magestique