mystic | aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7

Analysis

max time kernel
146s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 07:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe
Size 1.2MB
Sample231007-h8dz5aca76
SHA256 aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7
MD5 19373473cc896e8f8c6925fba51ee712
SHA1 de3dcf041132a75b2bfc6d8fecd3df5ef09ec060
SHA512 e8248657272aa4767bdf9a7e87ed58ec25c8f6e8982fa15d9ed3cbbbf7925262631fb14300568fecf197dfa33b1e623b0415b13fa849b1a1c68144cc17bd4fa4
SSDEEP 24576:3yDQ6zkL5fS+Ae2zlyi1yTa+rAtaozZwnG2edX5q00afq+s/rf:CDQ6QVfNAezi1y2+oyncO09sD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/4348-35-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4348-36-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4348-37-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4348-39-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00060000000230da-41.dat	family_redline
behavioral1/files/0x00060000000230da-42.dat	family_redline
behavioral1/memory/2024-44-0x00000000003E0000-0x000000000041E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
1384	Be6bd0qZ.exe
3132	Cv9zN2tL.exe
2140	sD1zk4to.exe
3276	TE7Vo9Ds.exe
4988	1Ud26Gb6.exe
2024	2ZG165JU.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Be6bd0qZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Cv9zN2tL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	sD1zk4to.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	TE7Vo9Ds.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4988 set thread context of 4348	4988	1Ud26Gb6.exe	94

Program crash 2 IoCs

pid	pid_target	Process	procid_target
808	4988	WerFault.exe	92
1332	4348	WerFault.exe	94

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 1384	3876	aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe	87
PID 3876 wrote to memory of 1384	3876	aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe	87
PID 3876 wrote to memory of 1384	3876	aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe	87
PID 1384 wrote to memory of 3132	1384	Be6bd0qZ.exe	88
PID 1384 wrote to memory of 3132	1384	Be6bd0qZ.exe	88
PID 1384 wrote to memory of 3132	1384	Be6bd0qZ.exe	88
PID 3132 wrote to memory of 2140	3132	Cv9zN2tL.exe	89
PID 3132 wrote to memory of 2140	3132	Cv9zN2tL.exe	89
PID 3132 wrote to memory of 2140	3132	Cv9zN2tL.exe	89
PID 2140 wrote to memory of 3276	2140	sD1zk4to.exe	90
PID 2140 wrote to memory of 3276	2140	sD1zk4to.exe	90
PID 2140 wrote to memory of 3276	2140	sD1zk4to.exe	90
PID 3276 wrote to memory of 4988	3276	TE7Vo9Ds.exe	92
PID 3276 wrote to memory of 4988	3276	TE7Vo9Ds.exe	92
PID 3276 wrote to memory of 4988	3276	TE7Vo9Ds.exe	92
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 4988 wrote to memory of 4348	4988	1Ud26Gb6.exe	94
PID 3276 wrote to memory of 2024	3276	TE7Vo9Ds.exe	99
PID 3276 wrote to memory of 2024	3276	TE7Vo9Ds.exe	99
PID 3276 wrote to memory of 2024	3276	TE7Vo9Ds.exe	99

C:\Users\Admin\AppData\Local\Temp\aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe
"C:\Users\Admin\AppData\Local\Temp\aa655275f38f95ad181fd5383b3b6a42f964b866a412aca2c72ce7fac1371ab7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Be6bd0qZ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Be6bd0qZ.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Cv9zN2tL.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Cv9zN2tL.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sD1zk4to.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sD1zk4to.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TE7Vo9Ds.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TE7Vo9Ds.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ud26Gb6.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ud26Gb6.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 540
        8⤵
        Program crash
        
        PID:1332
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 256
        7⤵
        Program crash
        
        PID:808
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZG165JU.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZG165JU.exe
        6⤵
        Executes dropped EXE
        
        PID:2024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4988 -ip 4988
1⤵
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4348 -ip 4348
1⤵
PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Be6bd0qZ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Be6bd0qZ.exe
Size 1.0MB
SHA256 fda3493c000aa04c784320c1731f04eed724fef6b7a2907bd8146d651ac03e51
MD5 7843b1dfa0dce3aa6dd2cbd56d872b73
SHA1 c2fbe3bb006bfcb702f2b8839cef3afc86d08bb1
SHA512 a541ec820549dfba07a58824f32b6e791b193e942d44e7c241c04c3ff8ee6c71d7c5c62900cb7aa4c2902a0e8b6e0c6cf3ed6c8d361cda87a56521644c290aa2
SSDEEP 24576:HyA7rey71K4qlIiD9/h+NArLoxZfnJne70afqks/9:SA7r44iD9ZhoPnkB7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Be6bd0qZ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Be6bd0qZ.exe
Size 1.0MB
SHA256 fda3493c000aa04c784320c1731f04eed724fef6b7a2907bd8146d651ac03e51
MD5 7843b1dfa0dce3aa6dd2cbd56d872b73
SHA1 c2fbe3bb006bfcb702f2b8839cef3afc86d08bb1
SHA512 a541ec820549dfba07a58824f32b6e791b193e942d44e7c241c04c3ff8ee6c71d7c5c62900cb7aa4c2902a0e8b6e0c6cf3ed6c8d361cda87a56521644c290aa2
SSDEEP 24576:HyA7rey71K4qlIiD9/h+NArLoxZfnJne70afqks/9:SA7r44iD9ZhoPnkB7s
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cv9zN2tL.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Cv9zN2tL.exe
Size 884KB
SHA256 f8bc356dea62e37d4626b00a1139d4fcbb99f1fd331da8cf70d2eb0c550b0924
MD5 ce6f44c5275fff27b86d2e68c8a987c7
SHA1 277d49ee02f6908688082db1b32fe715956d788b
SHA512 cc3537c30d06a6b49b0f7f64e1f458a4ff0dba353d6226f05d66b9ec0c749a028b7344c5b3d9cbea8bafd1ba9d8b390cb8bd39730370037b202d6039cfafab02
SSDEEP 12288:EMrDy90tQFR4vkKUYNvOTdVsrLGi3BC/f+rJMiparWvBrfMe1AZ2nnv/sRt:nykaKJyxiRC/f+58rGxaZ2nHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cv9zN2tL.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Cv9zN2tL.exe
Size 884KB
SHA256 f8bc356dea62e37d4626b00a1139d4fcbb99f1fd331da8cf70d2eb0c550b0924
MD5 ce6f44c5275fff27b86d2e68c8a987c7
SHA1 277d49ee02f6908688082db1b32fe715956d788b
SHA512 cc3537c30d06a6b49b0f7f64e1f458a4ff0dba353d6226f05d66b9ec0c749a028b7344c5b3d9cbea8bafd1ba9d8b390cb8bd39730370037b202d6039cfafab02
SSDEEP 12288:EMrDy90tQFR4vkKUYNvOTdVsrLGi3BC/f+rJMiparWvBrfMe1AZ2nnv/sRt:nykaKJyxiRC/f+58rGxaZ2nHA
MD5 SHA1 SHA512 SSDEEP

Submit Download

sD1zk4to.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sD1zk4to.exe
Size 590KB
SHA256 db64107244379d86b5d02b3c044a50db07a9fab76b1b3a3e0015793108bf1faf
MD5 e9ee293e5980566ede036a70a0ad35d6
SHA1 dce67412f0724fe8b561d82f20cd4df7c5432f27
SHA512 add30fdc0e48808b878eaeb4a8ea7a788c6ce05140332866480b6badee7240ce13a853c9d0ecea1aec2cc8ee4723b11c54db305a82d2cdfe272885c6d74704af
SSDEEP 12288:QMrxy90QC0WI3dVs3Qqi3z8/V+Vm3iEr6IPLmOPN:xyWLoOij8/V+JpgpPN
MD5 SHA1 SHA512 SSDEEP

Submit Download

sD1zk4to.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sD1zk4to.exe
Size 590KB
SHA256 db64107244379d86b5d02b3c044a50db07a9fab76b1b3a3e0015793108bf1faf
MD5 e9ee293e5980566ede036a70a0ad35d6
SHA1 dce67412f0724fe8b561d82f20cd4df7c5432f27
SHA512 add30fdc0e48808b878eaeb4a8ea7a788c6ce05140332866480b6badee7240ce13a853c9d0ecea1aec2cc8ee4723b11c54db305a82d2cdfe272885c6d74704af
SSDEEP 12288:QMrxy90QC0WI3dVs3Qqi3z8/V+Vm3iEr6IPLmOPN:xyWLoOij8/V+JpgpPN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TE7Vo9Ds.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TE7Vo9Ds.exe
Size 417KB
SHA256 7b80c0170b77179545495007e6a16319be71393d2f2cff71b06a4bbe29ff95d1
MD5 929fc630a500f521aa4cf19b3c15f15f
SHA1 25294f9be26745942693e25cafdbaaaeb05372df
SHA512 dae5bbd842e4cd7176040003069bc791a5be2b8a27a4b4984d7a1cdbfaf1aa9baca3b30b89527c9a1495d825daaaccd7608bad944c2eb75238553cdbc400eab6
SSDEEP 6144:KJy+bnr+Wp0yN90QEr6uFCuzf8i/mEPtm+aiGEaC9c2fpeUM:PMrWy909jCuLl/mEVm1iVrTIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

TE7Vo9Ds.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\TE7Vo9Ds.exe
Size 417KB
SHA256 7b80c0170b77179545495007e6a16319be71393d2f2cff71b06a4bbe29ff95d1
MD5 929fc630a500f521aa4cf19b3c15f15f
SHA1 25294f9be26745942693e25cafdbaaaeb05372df
SHA512 dae5bbd842e4cd7176040003069bc791a5be2b8a27a4b4984d7a1cdbfaf1aa9baca3b30b89527c9a1495d825daaaccd7608bad944c2eb75238553cdbc400eab6
SSDEEP 6144:KJy+bnr+Wp0yN90QEr6uFCuzf8i/mEPtm+aiGEaC9c2fpeUM:PMrWy909jCuLl/mEVm1iVrTIP
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Ud26Gb6.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ud26Gb6.exe
Size 378KB
SHA256 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
MD5 f0831f173733de08511f3a0739f278a6
SHA1 06dc809d653c5d2c97386084ae13b50a73eb5b60
SHA512 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
SSDEEP 6144:u4nS392pCryG4kfjSGwEi56AO0GzrdyO78RanL1uOBKtFOqSjcQMjdpL0D:u4nk2wryNStHboR4/1tMj7oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Ud26Gb6.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ud26Gb6.exe
Size 378KB
SHA256 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
MD5 f0831f173733de08511f3a0739f278a6
SHA1 06dc809d653c5d2c97386084ae13b50a73eb5b60
SHA512 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
SSDEEP 6144:u4nS392pCryG4kfjSGwEi56AO0GzrdyO78RanL1uOBKtFOqSjcQMjdpL0D:u4nk2wryNStHboR4/1tMj7oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ZG165JU.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZG165JU.exe
Size 231KB
SHA256 853dbad27eb3e953bca60776d8f1711eac4b231e7f79d69a23aa629782862528
MD5 443aaf1c26cf859080674f3fadf58ac5
SHA1 98baaa3627b75a733bc9aee8cff09e5a6fdb4da3
SHA512 7aefdc15a06aa74b9ca2443dba681d62668f780495fc97935acf37eed4e128f3f1720f874c4c113bf067f7eba277bdc9b03a2fb11d4ade4240f8a9ee9e1a0ad1
SSDEEP 3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ZG165JU.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZG165JU.exe
Size 231KB
SHA256 853dbad27eb3e953bca60776d8f1711eac4b231e7f79d69a23aa629782862528
MD5 443aaf1c26cf859080674f3fadf58ac5
SHA1 98baaa3627b75a733bc9aee8cff09e5a6fdb4da3
SHA512 7aefdc15a06aa74b9ca2443dba681d62668f780495fc97935acf37eed4e128f3f1720f874c4c113bf067f7eba277bdc9b03a2fb11d4ade4240f8a9ee9e1a0ad1
SSDEEP 3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2024-46-0x00000000071D0000-0x0000000007262000-memory.dmp

Download

memory/2024-48-0x00000000071C0000-0x00000000071CA000-memory.dmp

Download

memory/2024-55-0x00000000073E0000-0x00000000073F0000-memory.dmp

Download

memory/2024-54-0x0000000074010000-0x00000000747C0000-memory.dmp

Download

memory/2024-43-0x0000000074010000-0x00000000747C0000-memory.dmp

Download

memory/2024-44-0x00000000003E0000-0x000000000041E000-memory.dmp

Download

memory/2024-45-0x00000000076E0000-0x0000000007C84000-memory.dmp

Download

memory/2024-53-0x00000000074D0000-0x000000000751C000-memory.dmp

Download

memory/2024-52-0x0000000007490000-0x00000000074CC000-memory.dmp

Download

memory/2024-49-0x00000000082B0000-0x00000000088C8000-memory.dmp

Download

memory/2024-47-0x00000000073E0000-0x00000000073F0000-memory.dmp

Download

memory/2024-50-0x0000000007590000-0x000000000769A000-memory.dmp

Download

memory/2024-51-0x0000000007430000-0x0000000007442000-memory.dmp

Download

memory/4348-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4348-36-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4348-37-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4348-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads