mystic | 0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e

Analysis

max time kernel
143s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 06:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe
Size 1.2MB
Sample231007-hdzckshe81
SHA256 0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e
MD5 1a60bd560307b2bc5f296236b712d04d
SHA1 e27e61df43a504e4ae76ce8598fa7e30635f5c52
SHA512 88eed991bae751de16fffd6a91b90eebdbeee4643e5dd3a3b1364f363ad0836af5eb71eab3fe9062f12356320c92ab92ca8be5293960e85ae5ba4a2ce39adf4b
SSDEEP 24576:qyRG0Xu0fSL+Jm0U5WE+e9uRierIoFqEvdO7MQdjcozQ:xR9Xu0f00m0U5F5q9hlO4Qdjco
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/4496-35-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4496-36-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4496-37-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4496-39-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00060000000230b6-41.dat	family_redline
behavioral1/files/0x00060000000230b6-42.dat	family_redline
behavioral1/memory/4208-44-0x00000000006B0000-0x00000000006EE000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
2892	HU6bU2zX.exe
4792	Tf4Qq6ir.exe
2604	xj7yc2FE.exe
4940	am6JF9VV.exe
1412	1SB98Yb3.exe
4208	2IX790bp.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	HU6bU2zX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Tf4Qq6ir.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	xj7yc2FE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	am6JF9VV.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 4496	1412	1SB98Yb3.exe	94

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4320	4496	WerFault.exe	94
2804	1412	WerFault.exe	92

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1336 wrote to memory of 2892	1336	0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe	86
PID 1336 wrote to memory of 2892	1336	0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe	86
PID 1336 wrote to memory of 2892	1336	0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe	86
PID 2892 wrote to memory of 4792	2892	HU6bU2zX.exe	87
PID 2892 wrote to memory of 4792	2892	HU6bU2zX.exe	87
PID 2892 wrote to memory of 4792	2892	HU6bU2zX.exe	87
PID 4792 wrote to memory of 2604	4792	Tf4Qq6ir.exe	88
PID 4792 wrote to memory of 2604	4792	Tf4Qq6ir.exe	88
PID 4792 wrote to memory of 2604	4792	Tf4Qq6ir.exe	88
PID 2604 wrote to memory of 4940	2604	xj7yc2FE.exe	89
PID 2604 wrote to memory of 4940	2604	xj7yc2FE.exe	89
PID 2604 wrote to memory of 4940	2604	xj7yc2FE.exe	89
PID 4940 wrote to memory of 1412	4940	am6JF9VV.exe	92
PID 4940 wrote to memory of 1412	4940	am6JF9VV.exe	92
PID 4940 wrote to memory of 1412	4940	am6JF9VV.exe	92
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 1412 wrote to memory of 4496	1412	1SB98Yb3.exe	94
PID 4940 wrote to memory of 4208	4940	am6JF9VV.exe	99
PID 4940 wrote to memory of 4208	4940	am6JF9VV.exe	99
PID 4940 wrote to memory of 4208	4940	am6JF9VV.exe	99

C:\Users\Admin\AppData\Local\Temp\0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe
"C:\Users\Admin\AppData\Local\Temp\0bd838102a59a3cecddbafddd887bbd6011c2493139cbb02b92c9854e54e818e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1336
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HU6bU2zX.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HU6bU2zX.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tf4Qq6ir.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tf4Qq6ir.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xj7yc2FE.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xj7yc2FE.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\am6JF9VV.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\am6JF9VV.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1SB98Yb3.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1SB98Yb3.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 540
        8⤵
        Program crash
        
        PID:4320
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1412 -s 592
        7⤵
        Program crash
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IX790bp.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IX790bp.exe
        6⤵
        Executes dropped EXE
        
        PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1412 -ip 1412
1⤵
PID:484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4496 -ip 4496
1⤵
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HU6bU2zX.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HU6bU2zX.exe
Size 1.0MB
SHA256 d3fee70d94431e52d200a63f4567afb7bb6c46e858af9ba950a20875b7e97f85
MD5 4eb358726ab33ecb93f4d7d8e675f0ab
SHA1 2a445dbfc6e033ee944a7872a713a1b87b2423e6
SHA512 0db67e293360315c2fd0721cc267e482975ce1a5202b2cae286b9d4380709b38bda8096e460ccd2f1c085af454f5928b086c7e2d53531d575443ad4caf65e5b0
SSDEEP 24576:WyCSlfLdkSifW9+CoY9BvJAoFDTvdO7jQSTP:lCShprifMuU1/lOfQST
MD5 SHA1 SHA512 SSDEEP

Submit Download

HU6bU2zX.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\HU6bU2zX.exe
Size 1.0MB
SHA256 d3fee70d94431e52d200a63f4567afb7bb6c46e858af9ba950a20875b7e97f85
MD5 4eb358726ab33ecb93f4d7d8e675f0ab
SHA1 2a445dbfc6e033ee944a7872a713a1b87b2423e6
SHA512 0db67e293360315c2fd0721cc267e482975ce1a5202b2cae286b9d4380709b38bda8096e460ccd2f1c085af454f5928b086c7e2d53531d575443ad4caf65e5b0
SSDEEP 24576:WyCSlfLdkSifW9+CoY9BvJAoFDTvdO7jQSTP:lCShprifMuU1/lOfQST
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tf4Qq6ir.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tf4Qq6ir.exe
Size 884KB
SHA256 fbf4f36b96d4ed8eeb3e243c276d12bf48a0e22ff536e72915bfe71a8c216483
MD5 7ac0cb89ff10964c2bebca35b4eb3f2d
SHA1 5c8334febcdd83e78b85867161de1e9323b38d69
SHA512 8b1130d5e4e630a48008d9e3a829a69ab14f4d7ce126f67c1c9503d827692b6266774769df56a48c7e26a6ad57eeee964acf35c8701f9961145fa0bf3fa34080
SSDEEP 12288:cMrzy90TfDnbfbhy6buUWB0/5+Qp2ivl+lboLkNasXJBdUnvoFNXIvdc75Wr:vyOrM6eB0/5+Id+j7vavoFN4vdc78
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tf4Qq6ir.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Tf4Qq6ir.exe
Size 884KB
SHA256 fbf4f36b96d4ed8eeb3e243c276d12bf48a0e22ff536e72915bfe71a8c216483
MD5 7ac0cb89ff10964c2bebca35b4eb3f2d
SHA1 5c8334febcdd83e78b85867161de1e9323b38d69
SHA512 8b1130d5e4e630a48008d9e3a829a69ab14f4d7ce126f67c1c9503d827692b6266774769df56a48c7e26a6ad57eeee964acf35c8701f9961145fa0bf3fa34080
SSDEEP 12288:cMrzy90TfDnbfbhy6buUWB0/5+Qp2ivl+lboLkNasXJBdUnvoFNXIvdc75Wr:vyOrM6eB0/5+Id+j7vavoFN4vdc78
MD5 SHA1 SHA512 SSDEEP

Submit Download

xj7yc2FE.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xj7yc2FE.exe
Size 590KB
SHA256 479bcf7c087b5fb301b0081f2d1e6c3602fe50cbddf4dd210aa205b0c80eb056
MD5 6f6b475320119aecdf0a041940427da6
SHA1 a194eb38cb188240ef8d532f2658246cc3d0ea12
SHA512 b1638dcad07d3600c5fda6a47cd4a68de8450cf07b3d4ddf78b971771ba3037f055b67c6eb8a0dfa2adcfe8021884ce008d27ad75a92b460e19dbd5f3e06836b
SSDEEP 12288:lMrPy90phFKbCUHos/V+Vm7iEr3lkNq1pxZ5:KyObKDos/V+Fqlmep/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

xj7yc2FE.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\xj7yc2FE.exe
Size 590KB
SHA256 479bcf7c087b5fb301b0081f2d1e6c3602fe50cbddf4dd210aa205b0c80eb056
MD5 6f6b475320119aecdf0a041940427da6
SHA1 a194eb38cb188240ef8d532f2658246cc3d0ea12
SHA512 b1638dcad07d3600c5fda6a47cd4a68de8450cf07b3d4ddf78b971771ba3037f055b67c6eb8a0dfa2adcfe8021884ce008d27ad75a92b460e19dbd5f3e06836b
SSDEEP 12288:lMrPy90phFKbCUHos/V+Vm7iEr3lkNq1pxZ5:KyObKDos/V+Fqlmep/5
MD5 SHA1 SHA512 SSDEEP

Submit Download

am6JF9VV.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\am6JF9VV.exe
Size 417KB
SHA256 b9aec8a9998f49bf9648758fc2763d5d7dbe416cc865337fd8a685073b162a65
MD5 b7e1ab0552a8e4cad09e4f8a7bce8174
SHA1 b122a7206bcf10ad6b9451abd4da6be56b50a1dd
SHA512 5cc71eae770fd8f90dd45bb57ab71c766a90bd0d0ef4eb1179cd4ecc40bb28771658579376f8c8add2eb16a8ca166cc970ecdb3786b0622908217ce54798232a
SSDEEP 6144:Kpy+bnr+2p0yN90QEe6uFCuzf8i/mEPtm+aiGEaC9c2faP:HMrGy90sjCuLl/mEVm1iVrTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

am6JF9VV.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\am6JF9VV.exe
Size 417KB
SHA256 b9aec8a9998f49bf9648758fc2763d5d7dbe416cc865337fd8a685073b162a65
MD5 b7e1ab0552a8e4cad09e4f8a7bce8174
SHA1 b122a7206bcf10ad6b9451abd4da6be56b50a1dd
SHA512 5cc71eae770fd8f90dd45bb57ab71c766a90bd0d0ef4eb1179cd4ecc40bb28771658579376f8c8add2eb16a8ca166cc970ecdb3786b0622908217ce54798232a
SSDEEP 6144:Kpy+bnr+2p0yN90QEe6uFCuzf8i/mEPtm+aiGEaC9c2faP:HMrGy90sjCuLl/mEVm1iVrTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

1SB98Yb3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1SB98Yb3.exe
Size 378KB
SHA256 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
MD5 f0831f173733de08511f3a0739f278a6
SHA1 06dc809d653c5d2c97386084ae13b50a73eb5b60
SHA512 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
SSDEEP 6144:u4nS392pCryG4kfjSGwEi56AO0GzrdyO78RanL1uOBKtFOqSjcQMjdpL0D:u4nk2wryNStHboR4/1tMj7oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1SB98Yb3.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1SB98Yb3.exe
Size 378KB
SHA256 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
MD5 f0831f173733de08511f3a0739f278a6
SHA1 06dc809d653c5d2c97386084ae13b50a73eb5b60
SHA512 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
SSDEEP 6144:u4nS392pCryG4kfjSGwEi56AO0GzrdyO78RanL1uOBKtFOqSjcQMjdpL0D:u4nk2wryNStHboR4/1tMj7oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

2IX790bp.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IX790bp.exe
Size 231KB
SHA256 2d6e7f036137cdb0ba4d33a562666971a5638cb741ae94ee5906bb915a5ce4f7
MD5 3ac14c086ef72502c09ec81cff9bc6f7
SHA1 c68f1313ad20747083f8e58123ba7658b1343132
SHA512 d36bbf47d4a910af918aa0b97ff9a563ba32964f3fa4ef2566d5d394883ff74caa735eee87891662fbc0bb39ba10d396f5c03ff154921c5f341518b69bd53a3d
SSDEEP 3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK
MD5 SHA1 SHA512 SSDEEP

Submit Download

2IX790bp.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2IX790bp.exe
Size 231KB
SHA256 2d6e7f036137cdb0ba4d33a562666971a5638cb741ae94ee5906bb915a5ce4f7
MD5 3ac14c086ef72502c09ec81cff9bc6f7
SHA1 c68f1313ad20747083f8e58123ba7658b1343132
SHA512 d36bbf47d4a910af918aa0b97ff9a563ba32964f3fa4ef2566d5d394883ff74caa735eee87891662fbc0bb39ba10d396f5c03ff154921c5f341518b69bd53a3d
SSDEEP 3072:sgspAnCNgcepupXKLh8DjV7OGt/qasDrTv+mIqd44oKG6g:jOACNgceQpXKLKdr/ODrTmmpd44oK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4208-46-0x00000000075B0000-0x0000000007642000-memory.dmp

Download

memory/4208-48-0x0000000007780000-0x000000000778A000-memory.dmp

Download

memory/4208-55-0x0000000007760000-0x0000000007770000-memory.dmp

Download

memory/4208-54-0x0000000073FA0000-0x0000000074750000-memory.dmp

Download

memory/4208-43-0x0000000073FA0000-0x0000000074750000-memory.dmp

Download

memory/4208-44-0x00000000006B0000-0x00000000006EE000-memory.dmp

Download

memory/4208-45-0x0000000007A80000-0x0000000008024000-memory.dmp

Download

memory/4208-53-0x0000000007A30000-0x0000000007A7C000-memory.dmp

Download

memory/4208-52-0x00000000078B0000-0x00000000078EC000-memory.dmp

Download

memory/4208-49-0x0000000008650000-0x0000000008C68000-memory.dmp

Download

memory/4208-47-0x0000000007760000-0x0000000007770000-memory.dmp

Download

memory/4208-50-0x0000000007920000-0x0000000007A2A000-memory.dmp

Download

memory/4208-51-0x0000000007850000-0x0000000007862000-memory.dmp

Download

memory/4496-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4496-36-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4496-37-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4496-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads