mystic | 968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe
Size 1.2MB
Sample231007-xcpt3sgh56
SHA256 968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a
MD5 4be99cfc87828f4df9354f48f3c6a188
SHA1 097f7e65ea23bdfbb489b2bd0df0e0d57bebd3ce
SHA512 d61410956fd706bd19ded81f89fe96b58628b52a847c155a471bbf7c4839a06a80773dc5de2229ad2938f2203f1dc06835762780e5cc050aae0c85e2b674e5cf
SSDEEP 24576:9y46gSLX2RUPoDmYYp4Fy4KNCj4Gntb1kgzTuPu6:Y46gEXS3KGFytAjR7Wu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline lutyr infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/3148-35-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3148-36-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3148-37-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3148-39-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/files/0x00080000000230d3-41.dat	family_redline
behavioral1/files/0x00080000000230d3-42.dat	family_redline
behavioral1/memory/4936-44-0x0000000000420000-0x000000000045E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
3132	tn0pZ3qR.exe
860	cr9Ka6cA.exe
972	GJ3ny5QC.exe
2752	Vy9iI0aa.exe
3000	1vn77uT2.exe
4936	2ZP714zJ.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	cr9Ka6cA.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	GJ3ny5QC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Vy9iI0aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tn0pZ3qR.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 3148	3000	1vn77uT2.exe	94

Program crash 2 IoCs

pid	pid_target	Process	procid_target
916	3148	WerFault.exe	94
4752	3000	WerFault.exe	92

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3132	3888	968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe	87
PID 3888 wrote to memory of 3132	3888	968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe	87
PID 3888 wrote to memory of 3132	3888	968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe	87
PID 3132 wrote to memory of 860	3132	tn0pZ3qR.exe	88
PID 3132 wrote to memory of 860	3132	tn0pZ3qR.exe	88
PID 3132 wrote to memory of 860	3132	tn0pZ3qR.exe	88
PID 860 wrote to memory of 972	860	cr9Ka6cA.exe	90
PID 860 wrote to memory of 972	860	cr9Ka6cA.exe	90
PID 860 wrote to memory of 972	860	cr9Ka6cA.exe	90
PID 972 wrote to memory of 2752	972	GJ3ny5QC.exe	91
PID 972 wrote to memory of 2752	972	GJ3ny5QC.exe	91
PID 972 wrote to memory of 2752	972	GJ3ny5QC.exe	91
PID 2752 wrote to memory of 3000	2752	Vy9iI0aa.exe	92
PID 2752 wrote to memory of 3000	2752	Vy9iI0aa.exe	92
PID 2752 wrote to memory of 3000	2752	Vy9iI0aa.exe	92
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 3000 wrote to memory of 3148	3000	1vn77uT2.exe	94
PID 2752 wrote to memory of 4936	2752	Vy9iI0aa.exe	99
PID 2752 wrote to memory of 4936	2752	Vy9iI0aa.exe	99
PID 2752 wrote to memory of 4936	2752	Vy9iI0aa.exe	99

C:\Users\Admin\AppData\Local\Temp\968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe
"C:\Users\Admin\AppData\Local\Temp\968c5a1bf53c7a85142c69165c083901604aafb1f7a89dcf0d6fc867a640495a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn0pZ3qR.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn0pZ3qR.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cr9Ka6cA.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cr9Ka6cA.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GJ3ny5QC.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GJ3ny5QC.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Vy9iI0aa.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Vy9iI0aa.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vn77uT2.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vn77uT2.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3000
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 556
        8⤵
        Program crash
        
        PID:916
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 616
        7⤵
        Program crash
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZP714zJ.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZP714zJ.exe
        6⤵
        Executes dropped EXE
        
        PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3000 -ip 3000
1⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3148 -ip 3148
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tn0pZ3qR.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn0pZ3qR.exe
Size 1.0MB
SHA256 aaed92a98322f9636dda280ad9eeb5134365894b32a708ab4c6bfb242d344704
MD5 fdfb5f5cc49617e9ce796f797b773e69
SHA1 f64158004a5172b57210619bbf50ec316f17d9f3
SHA512 e0af5623e6cc0ea725f7521771813f03899fb66be9eec2d265750bacec7f93710cd7a4369feacc56507af0a3641468ef4cc2d24e92ca0bc427dc4587e2184f50
SSDEEP 24576:6y49Xcb9ZU9o8yHAu2s6bFhujrWAtz1rgf:BoXWZt1es6BEjqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

tn0pZ3qR.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tn0pZ3qR.exe
Size 1.0MB
SHA256 aaed92a98322f9636dda280ad9eeb5134365894b32a708ab4c6bfb242d344704
MD5 fdfb5f5cc49617e9ce796f797b773e69
SHA1 f64158004a5172b57210619bbf50ec316f17d9f3
SHA512 e0af5623e6cc0ea725f7521771813f03899fb66be9eec2d265750bacec7f93710cd7a4369feacc56507af0a3641468ef4cc2d24e92ca0bc427dc4587e2184f50
SSDEEP 24576:6y49Xcb9ZU9o8yHAu2s6bFhujrWAtz1rgf:BoXWZt1es6BEjqk
MD5 SHA1 SHA512 SSDEEP

Submit Download

cr9Ka6cA.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cr9Ka6cA.exe
Size 879KB
SHA256 ed1fce5e419d0a993ca0adbbd711f7f51972442443336af90482b06b1f3aa955
MD5 6b688322df40af6ae2cad0195874b4c5
SHA1 e73c9227732ac28bbc486cdf53f97b3b66e03ba5
SHA512 c19e141d79959bd21d1a08cb423fe736192c1309278dd619dc32203b6ee0247b590fb4ca7007c68175a6409ef769b15db4ee527776a894a8c25c1fbebc8daad2
SSDEEP 12288:SMr0y90HXKmM8DgRx8JK3qvzb/wlsDuqPdsToSSiCsvyPb/TKVOJuMAZdjn1zmdo:iyNReJK8vEEg9D6bmhdjoUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cr9Ka6cA.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\cr9Ka6cA.exe
Size 879KB
SHA256 ed1fce5e419d0a993ca0adbbd711f7f51972442443336af90482b06b1f3aa955
MD5 6b688322df40af6ae2cad0195874b4c5
SHA1 e73c9227732ac28bbc486cdf53f97b3b66e03ba5
SHA512 c19e141d79959bd21d1a08cb423fe736192c1309278dd619dc32203b6ee0247b590fb4ca7007c68175a6409ef769b15db4ee527776a894a8c25c1fbebc8daad2
SSDEEP 12288:SMr0y90HXKmM8DgRx8JK3qvzb/wlsDuqPdsToSSiCsvyPb/TKVOJuMAZdjn1zmdo:iyNReJK8vEEg9D6bmhdjoUj
MD5 SHA1 SHA512 SSDEEP

Submit Download

GJ3ny5QC.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GJ3ny5QC.exe
Size 585KB
SHA256 65a9eec5796ef78e7bacd008bba845468619bd3ae43d84d0071bf1a5da98b948
MD5 5cfd6fc3e28e2fbb4d0cf27a606ebd27
SHA1 acc0dd6ca68906a75382073e775f90821944f557
SHA512 567220c8877154dddc1d2dd7b97331e2badbc01102617b12ff1abc1a222fc724fbd1bbcc1e4ee18e525af3261dd678307093f8597df6a8c5521cf9799a81f8fc
SSDEEP 12288:+Mrhy907Zx8ks3qvzU/dljDuFT3eiTtOSVvyPbbTKVOJf1:Hy2eks8uD8z5Ow6bb1
MD5 SHA1 SHA512 SSDEEP

Submit Download

GJ3ny5QC.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\GJ3ny5QC.exe
Size 585KB
SHA256 65a9eec5796ef78e7bacd008bba845468619bd3ae43d84d0071bf1a5da98b948
MD5 5cfd6fc3e28e2fbb4d0cf27a606ebd27
SHA1 acc0dd6ca68906a75382073e775f90821944f557
SHA512 567220c8877154dddc1d2dd7b97331e2badbc01102617b12ff1abc1a222fc724fbd1bbcc1e4ee18e525af3261dd678307093f8597df6a8c5521cf9799a81f8fc
SSDEEP 12288:+Mrhy907Zx8ks3qvzU/dljDuFT3eiTtOSVvyPbbTKVOJf1:Hy2eks8uD8z5Ow6bb1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vy9iI0aa.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Vy9iI0aa.exe
Size 413KB
SHA256 697fb4e91f312e84c830765d791ae1f1cc4113671b667a7f7b2fc1736bcc8401
MD5 0bab73b2a6eb87ecfcf0eb94bba0c787
SHA1 45f108eb8c39d346ebbcedf92491f25de652126a
SHA512 6d5f413ca3f56aaa93cff2c8b3e9b06ffe902caa707d43468568cea9590787bf544a81b7b4675b6f9667e5e3cfec4678f0bc41ac9e0f2cfb130724512d709be9
SSDEEP 6144:KRy+bnr+cp0yN90QEDY9OCwtQy5FlYuU7oT9k0umUTQ+Uns1QEqpTCs:XMr8y90uOXtPl7DuNTCs+TL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vy9iI0aa.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Vy9iI0aa.exe
Size 413KB
SHA256 697fb4e91f312e84c830765d791ae1f1cc4113671b667a7f7b2fc1736bcc8401
MD5 0bab73b2a6eb87ecfcf0eb94bba0c787
SHA1 45f108eb8c39d346ebbcedf92491f25de652126a
SHA512 6d5f413ca3f56aaa93cff2c8b3e9b06ffe902caa707d43468568cea9590787bf544a81b7b4675b6f9667e5e3cfec4678f0bc41ac9e0f2cfb130724512d709be9
SSDEEP 6144:KRy+bnr+cp0yN90QEDY9OCwtQy5FlYuU7oT9k0umUTQ+Uns1QEqpTCs:XMr8y90uOXtPl7DuNTCs+TL
MD5 SHA1 SHA512 SSDEEP

Submit Download

1vn77uT2.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vn77uT2.exe
Size 378KB
SHA256 1aa91e78fc6dcdfbf2871dce1494dd4fdec2420bb4a548d7152d5f2ab1ff2da1
MD5 8a77682cb289a57fd85acc6852383388
SHA1 f838ce67294a9324b5e0744cf6a01efe8ac3cf47
SHA512 7271671a440703ef6617c329f1e870a197cd6376b1b7df82a8fadaf89ae0d39d5581a273a27682750681bbaa2514cc873e3ae95bb3368696435868793c5bf22d
SSDEEP 6144:A4wSx92pCryG4kfjSGwEi56AOaGXwEL58VhSd24p6uBu3XvPM+0D:A4wK2wryNSPh2fM24ZAU3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

1vn77uT2.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1vn77uT2.exe
Size 378KB
SHA256 1aa91e78fc6dcdfbf2871dce1494dd4fdec2420bb4a548d7152d5f2ab1ff2da1
MD5 8a77682cb289a57fd85acc6852383388
SHA1 f838ce67294a9324b5e0744cf6a01efe8ac3cf47
SHA512 7271671a440703ef6617c329f1e870a197cd6376b1b7df82a8fadaf89ae0d39d5581a273a27682750681bbaa2514cc873e3ae95bb3368696435868793c5bf22d
SSDEEP 6144:A4wSx92pCryG4kfjSGwEi56AOaGXwEL58VhSd24p6uBu3XvPM+0D:A4wK2wryNSPh2fM24ZAU3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ZP714zJ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZP714zJ.exe
Size 221KB
SHA256 195e50a24b0953e94d250d161abd4191007e763b2b698d7d199603ba1ebcbe5f
MD5 d6e2d546aa0b89aea9bbf74e80acbfa3
SHA1 4febaa27c8e41f7e69130b695c458fae7f780500
SHA512 4b52464f6411265ff8b2b4c8097c1d3d12c0fc08b4981ef78cebfb7a1b950b580b50ab5ba058f97816e833ac6feffe803f0226f95fb9492ffe4f7368ddfd5ccc
SSDEEP 3072:yFyOHrnNNgchKkRm8pyUDv8ZTYllt/q0ePfm/lpvSLaeG:yFyOLNNgch5k80UDGYp/mPfmdJSLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

2ZP714zJ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2ZP714zJ.exe
Size 221KB
SHA256 195e50a24b0953e94d250d161abd4191007e763b2b698d7d199603ba1ebcbe5f
MD5 d6e2d546aa0b89aea9bbf74e80acbfa3
SHA1 4febaa27c8e41f7e69130b695c458fae7f780500
SHA512 4b52464f6411265ff8b2b4c8097c1d3d12c0fc08b4981ef78cebfb7a1b950b580b50ab5ba058f97816e833ac6feffe803f0226f95fb9492ffe4f7368ddfd5ccc
SSDEEP 3072:yFyOHrnNNgchKkRm8pyUDv8ZTYllt/q0ePfm/lpvSLaeG:yFyOLNNgch5k80UDGYp/mPfmdJSLa
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3148-36-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3148-37-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3148-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/3148-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4936-46-0x00000000072E0000-0x0000000007372000-memory.dmp

Download

memory/4936-44-0x0000000000420000-0x000000000045E000-memory.dmp

Download

memory/4936-45-0x00000000077F0000-0x0000000007D94000-memory.dmp

Download

memory/4936-43-0x0000000074130000-0x00000000748E0000-memory.dmp

Download

memory/4936-47-0x00000000072B0000-0x00000000072C0000-memory.dmp

Download

memory/4936-48-0x00000000074F0000-0x00000000074FA000-memory.dmp

Download

memory/4936-49-0x00000000083C0000-0x00000000089D8000-memory.dmp

Download

memory/4936-50-0x0000000007690000-0x000000000779A000-memory.dmp

Download

memory/4936-51-0x00000000075C0000-0x00000000075D2000-memory.dmp

Download

memory/4936-52-0x0000000007620000-0x000000000765C000-memory.dmp

Download

memory/4936-53-0x00000000077A0000-0x00000000077EC000-memory.dmp

Download

memory/4936-54-0x0000000074130000-0x00000000748E0000-memory.dmp

Download

memory/4936-55-0x00000000072B0000-0x00000000072C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads