mystic | e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe
Size

1.2MB
MD5

ed974ae3de86c69a6f5c807463948ccb
SHA1

769f8bd5816eed350070769627d06525f76f12f8
SHA256

e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796
SHA512

36e359c4e8003aa0cb67c86c9726672746d9f8183e8dc02a8d66f6c3368a9d395c04e381c5d1c2c51bdc6f7264dfb29e6736513c1538717218e2c4eef37a5708
SSDEEP

24576:fyeUyRGbDVQC1PTwuV1ceIL7iVJp81sv7xl5of92:qouCCtTwuV1e7ibplCf

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/928-35-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/928-36-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/928-37-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/928-39-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00060000000231f8-41.dat	family_redline
behavioral1/files/0x00060000000231f8-42.dat	family_redline
behavioral1/memory/4464-43-0x0000000000DB0000-0x0000000000DEE000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3372	ez7qH7Hl.exe
4024	KZ5Cj4UV.exe
4128	Tu1gZ7Ae.exe
1108	LB6Oj5xu.exe
4976	1nC21jB0.exe
4464	2jm787uT.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Tu1gZ7Ae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	LB6Oj5xu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ez7qH7Hl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	KZ5Cj4UV.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4976 set thread context of 928	4976	1nC21jB0.exe	93

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3908	928	WerFault.exe	93
4588	4976	WerFault.exe	90

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 3372	4428	e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe	85
PID 4428 wrote to memory of 3372	4428	e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe	85
PID 4428 wrote to memory of 3372	4428	e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe	85
PID 3372 wrote to memory of 4024	3372	ez7qH7Hl.exe	86
PID 3372 wrote to memory of 4024	3372	ez7qH7Hl.exe	86
PID 3372 wrote to memory of 4024	3372	ez7qH7Hl.exe	86
PID 4024 wrote to memory of 4128	4024	KZ5Cj4UV.exe	88
PID 4024 wrote to memory of 4128	4024	KZ5Cj4UV.exe	88
PID 4024 wrote to memory of 4128	4024	KZ5Cj4UV.exe	88
PID 4128 wrote to memory of 1108	4128	Tu1gZ7Ae.exe	89
PID 4128 wrote to memory of 1108	4128	Tu1gZ7Ae.exe	89
PID 4128 wrote to memory of 1108	4128	Tu1gZ7Ae.exe	89
PID 1108 wrote to memory of 4976	1108	LB6Oj5xu.exe	90
PID 1108 wrote to memory of 4976	1108	LB6Oj5xu.exe	90
PID 1108 wrote to memory of 4976	1108	LB6Oj5xu.exe	90
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 4976 wrote to memory of 928	4976	1nC21jB0.exe	93
PID 1108 wrote to memory of 4464	1108	LB6Oj5xu.exe	102
PID 1108 wrote to memory of 4464	1108	LB6Oj5xu.exe	102
PID 1108 wrote to memory of 4464	1108	LB6Oj5xu.exe	102

C:\Users\Admin\AppData\Local\Temp\e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe
"C:\Users\Admin\AppData\Local\Temp\e8bf7b5c22a787af15a42638894b8f1eccc3320134f42f09939f4932df0cc796.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ez7qH7Hl.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ez7qH7Hl.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KZ5Cj4UV.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KZ5Cj4UV.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tu1gZ7Ae.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tu1gZ7Ae.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4128
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LB6Oj5xu.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LB6Oj5xu.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1108
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1nC21jB0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1nC21jB0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4976
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:928
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 928 -s 540
        8⤵
        Program crash
        
        PID:3908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 152
        7⤵
        Program crash
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jm787uT.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jm787uT.exe
        6⤵
        Executes dropped EXE
        
        PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 928 -ip 928
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4976 -ip 4976
1⤵
PID:4696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ez7qH7Hl.exe

Filesize
1.0MB

MD5
b7082bd6ffbd108facae7a48c0ee3288

SHA1
32b654e2bb9dfab58479b09fe338ff88873a0725

SHA256
305fedb6ded7251e991835d640652072ad971465935386335c8a12c846c895fb

SHA512
69abe778489e2b84262a141e3e414812fcd5365957ab70a31f87107fe3a8fd779da31d9598963f822a10b661eb02bbb8ba1b4c68456b503ea3c4bb4d407ce762

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ez7qH7Hl.exe

Filesize
1.0MB

MD5
b7082bd6ffbd108facae7a48c0ee3288

SHA1
32b654e2bb9dfab58479b09fe338ff88873a0725

SHA256
305fedb6ded7251e991835d640652072ad971465935386335c8a12c846c895fb

SHA512
69abe778489e2b84262a141e3e414812fcd5365957ab70a31f87107fe3a8fd779da31d9598963f822a10b661eb02bbb8ba1b4c68456b503ea3c4bb4d407ce762

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KZ5Cj4UV.exe

Filesize
884KB

MD5
8ba63232d9e9bb04767bb158c234ec3d

SHA1
d7e1aaf252796fa97b942ec16111249e15927491

SHA256
7ef92e3c87f4a2074a2cba8ba4bc7275b6ce070e182eb5647ead3ededeae7718

SHA512
8d4cb571c6ccd1bad09dddf78b4b4e557e5e92745a101a8e80bab5c050dea536b9246aedd584210f5b42a873846a2ec54f5ee3db2519783c8224234bddbabd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\KZ5Cj4UV.exe

Filesize
884KB

MD5
8ba63232d9e9bb04767bb158c234ec3d

SHA1
d7e1aaf252796fa97b942ec16111249e15927491

SHA256
7ef92e3c87f4a2074a2cba8ba4bc7275b6ce070e182eb5647ead3ededeae7718

SHA512
8d4cb571c6ccd1bad09dddf78b4b4e557e5e92745a101a8e80bab5c050dea536b9246aedd584210f5b42a873846a2ec54f5ee3db2519783c8224234bddbabd24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tu1gZ7Ae.exe

Filesize
590KB

MD5
2adfbdff71a6b437129e88d5fe05acfc

SHA1
e8b46ba22a6986f2242fbd7acc3ab5ca1753d622

SHA256
2693ed0e12f978d06aebb89cc23ed483902ae40330ba2c3e8d219896b93bd2b3

SHA512
dbc78c802c1ece32c1f28a078bb53c00bba66aa7c5ed60761ffe462d98867393866b39a93dc2301730cb2d8e2c6593d48a60258b74b9e52a30add34e42d374ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Tu1gZ7Ae.exe

Filesize
590KB

MD5
2adfbdff71a6b437129e88d5fe05acfc

SHA1
e8b46ba22a6986f2242fbd7acc3ab5ca1753d622

SHA256
2693ed0e12f978d06aebb89cc23ed483902ae40330ba2c3e8d219896b93bd2b3

SHA512
dbc78c802c1ece32c1f28a078bb53c00bba66aa7c5ed60761ffe462d98867393866b39a93dc2301730cb2d8e2c6593d48a60258b74b9e52a30add34e42d374ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LB6Oj5xu.exe

Filesize
417KB

MD5
759eff040727f8b3c3c7030fd6a8e9dd

SHA1
39db7a440be528b329066b9a64f30902143b715d

SHA256
9c99a7b55895d236cf1659d937cd34bb9045cf8e477b8904619e25d04ade9d9f

SHA512
fa4279e7011a2fac51059988422305fb8145edfbb61290779aa8657023258cde29e8aaefe4868c27534edfd21d5c62abdcf7803ea6563bb5288eb5d928bff1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\LB6Oj5xu.exe

Filesize
417KB

MD5
759eff040727f8b3c3c7030fd6a8e9dd

SHA1
39db7a440be528b329066b9a64f30902143b715d

SHA256
9c99a7b55895d236cf1659d937cd34bb9045cf8e477b8904619e25d04ade9d9f

SHA512
fa4279e7011a2fac51059988422305fb8145edfbb61290779aa8657023258cde29e8aaefe4868c27534edfd21d5c62abdcf7803ea6563bb5288eb5d928bff1a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1nC21jB0.exe

Filesize
378KB

MD5
e1a5beaf63fbf2a3b7e2a718e79e005f

SHA1
67b6a43eb744d16a7acf2054e9cf112266ef69b1

SHA256
cea219782ac66dc7556943acd0da465ce591d75e8bf368a1323793604753cee8

SHA512
27f2a2223ffc2e961c5c1e1bf510df2fa9496868fb0643f8a04b7713767511dc887008253c84fa9e4b4bdb737d3f7dd7ba9a2ac7e5ad26302164890d770d21c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1nC21jB0.exe

Filesize
378KB

MD5
e1a5beaf63fbf2a3b7e2a718e79e005f

SHA1
67b6a43eb744d16a7acf2054e9cf112266ef69b1

SHA256
cea219782ac66dc7556943acd0da465ce591d75e8bf368a1323793604753cee8

SHA512
27f2a2223ffc2e961c5c1e1bf510df2fa9496868fb0643f8a04b7713767511dc887008253c84fa9e4b4bdb737d3f7dd7ba9a2ac7e5ad26302164890d770d21c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jm787uT.exe

Filesize
231KB

MD5
406c34ff6a8b7c77cb8c7eae9b3c93fb

SHA1
21e8948cdae257fc32a8f5c1ed867d865e7738ae

SHA256
e33329291b25a0544bb2ea12f9af925bc8dfab946cc92b105a372c8cf1b4dfb0

SHA512
b1c1c6355d840189312633253f7436a7f2536d590256498f62ff68c26a537ce4f85e8d5af167d9d26bb5c59f12e932729daa3c3fefbce806e22bc9648749c6f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jm787uT.exe

Filesize
231KB

MD5
406c34ff6a8b7c77cb8c7eae9b3c93fb

SHA1
21e8948cdae257fc32a8f5c1ed867d865e7738ae

SHA256
e33329291b25a0544bb2ea12f9af925bc8dfab946cc92b105a372c8cf1b4dfb0

SHA512
b1c1c6355d840189312633253f7436a7f2536d590256498f62ff68c26a537ce4f85e8d5af167d9d26bb5c59f12e932729daa3c3fefbce806e22bc9648749c6f7

Download Submit
memory/928-36-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/928-37-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/928-39-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/928-35-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4464-46-0x0000000007BA0000-0x0000000007C32000-memory.dmp

Filesize
584KB

Download
memory/4464-44-0x0000000073D40000-0x00000000744F0000-memory.dmp

Filesize
7.7MB

Download
memory/4464-45-0x00000000080B0000-0x0000000008654000-memory.dmp

Filesize
5.6MB

Download
memory/4464-43-0x0000000000DB0000-0x0000000000DEE000-memory.dmp

Filesize
248KB

Download
memory/4464-47-0x0000000007B30000-0x0000000007B40000-memory.dmp

Filesize
64KB

Download
memory/4464-48-0x0000000007D40000-0x0000000007D4A000-memory.dmp

Filesize
40KB

Download
memory/4464-49-0x0000000008C80000-0x0000000009298000-memory.dmp

Filesize
6.1MB

Download
memory/4464-50-0x0000000007EE0000-0x0000000007FEA000-memory.dmp

Filesize
1.0MB

Download
memory/4464-51-0x0000000007E10000-0x0000000007E22000-memory.dmp

Filesize
72KB

Download
memory/4464-52-0x0000000007E70000-0x0000000007EAC000-memory.dmp

Filesize
240KB

Download
memory/4464-53-0x0000000007FF0000-0x000000000803C000-memory.dmp

Filesize
304KB

Download
memory/4464-54-0x0000000073D40000-0x00000000744F0000-memory.dmp

Filesize
7.7MB

Download
memory/4464-55-0x0000000007B30000-0x0000000007B40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads