mystic | a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 22:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe
Size

928KB
MD5

7e9038f0075273341c946e6d0a898503
SHA1

6f137da0a8a75adfdafbde89dae5f18ff710fe96
SHA256

a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183
SHA512

d0f60d45acc701d23bb3d48c9e18b6a4388c1f0352b1cf91f008cc36da4f9354dacaaca919c2b47a0dd8d7a0f407950af2828617caa2cbc8564a8bfe6c93625b
SSDEEP

12288:ZMrYy90b3brxBN4FdFynLszbHw03KFvijorCSmsXzQMSrQMsiOc6H4AbZCG6AXz:Zy+bVBN4FdFSETw058sYQMuQMGc6H5D

Score

10^/10

mystic redline luska infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

luska

77.91.124.55:19071

Attributes

auth_value
a6797888f51a88afbfd8854a79ac9357

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1580-28-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1580-29-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1580-30-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1580-32-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
3544	x9079639.exe
1140	x7251593.exe
1788	x2309458.exe
948	g3061500.exe
3096	h6709550.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9079639.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7251593.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x2309458.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 948 set thread context of 1580	948	g3061500.exe	95

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4532	1580	WerFault.exe	95
4216	948	WerFault.exe	92

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3544	4964	a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe	89
PID 4964 wrote to memory of 3544	4964	a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe	89
PID 4964 wrote to memory of 3544	4964	a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe	89
PID 3544 wrote to memory of 1140	3544	x9079639.exe	90
PID 3544 wrote to memory of 1140	3544	x9079639.exe	90
PID 3544 wrote to memory of 1140	3544	x9079639.exe	90
PID 1140 wrote to memory of 1788	1140	x7251593.exe	91
PID 1140 wrote to memory of 1788	1140	x7251593.exe	91
PID 1140 wrote to memory of 1788	1140	x7251593.exe	91
PID 1788 wrote to memory of 948	1788	x2309458.exe	92
PID 1788 wrote to memory of 948	1788	x2309458.exe	92
PID 1788 wrote to memory of 948	1788	x2309458.exe	92
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 948 wrote to memory of 1580	948	g3061500.exe	95
PID 1788 wrote to memory of 3096	1788	x2309458.exe	102
PID 1788 wrote to memory of 3096	1788	x2309458.exe	102
PID 1788 wrote to memory of 3096	1788	x2309458.exe	102

C:\Users\Admin\AppData\Local\Temp\a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe
"C:\Users\Admin\AppData\Local\Temp\a347221b4d6b0e225e60632d367f931c47ce81a4d0bce1893c3d400bf39b9183.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9079639.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9079639.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7251593.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7251593.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1140
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2309458.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2309458.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3061500.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3061500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:948
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 560
        7⤵
        Program crash
        
        PID:4532
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 948 -s 156
        6⤵
        Program crash
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h6709550.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h6709550.exe
        5⤵
        Executes dropped EXE
        
        PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 948 -ip 948
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1580 -ip 1580
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9079639.exe

Filesize
826KB

MD5
8f175ca47a7d52480f9d7dbfd93845c4

SHA1
c76f60bd414932b07e247a84bd7766bd9367297c

SHA256
b5b4394b5e9a9bf2c6af82de5034519983289cab058b5690806f22bcabeb9bd2

SHA512
a7b30076be90aac169bf14396b8ed63615d0ec9d629e5a5bd0b723b4b8321618edd1124db14c2e79061630631b941d986683465e73d1beab8bc6524d817ee3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9079639.exe

Filesize
826KB

MD5
8f175ca47a7d52480f9d7dbfd93845c4

SHA1
c76f60bd414932b07e247a84bd7766bd9367297c

SHA256
b5b4394b5e9a9bf2c6af82de5034519983289cab058b5690806f22bcabeb9bd2

SHA512
a7b30076be90aac169bf14396b8ed63615d0ec9d629e5a5bd0b723b4b8321618edd1124db14c2e79061630631b941d986683465e73d1beab8bc6524d817ee3ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7251593.exe

Filesize
555KB

MD5
7abc43a033ed31c3b5f2c4979f09c60e

SHA1
5880cbf58877c8a75a65b5c4cc5a56ec314c8148

SHA256
7215e5959bb4c73628a52e1631c00f71e743a2574e0d14524b5fc1e69bdacd62

SHA512
5a2b3ea983b905a2b9dc7505c6330edfef88b483f9f63ab780ff29d95a3f7b1211835d71513cdc7a87311cd6ecb18525aa6d32c223ce3eb74db13b26ee20a23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7251593.exe

Filesize
555KB

MD5
7abc43a033ed31c3b5f2c4979f09c60e

SHA1
5880cbf58877c8a75a65b5c4cc5a56ec314c8148

SHA256
7215e5959bb4c73628a52e1631c00f71e743a2574e0d14524b5fc1e69bdacd62

SHA512
5a2b3ea983b905a2b9dc7505c6330edfef88b483f9f63ab780ff29d95a3f7b1211835d71513cdc7a87311cd6ecb18525aa6d32c223ce3eb74db13b26ee20a23e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2309458.exe

Filesize
390KB

MD5
e646f28ea1f6dff6cf3fb3fe0bf1df0e

SHA1
9dab2697a30318712c67e6cd8060fee4b3867ccb

SHA256
b4e078259f98bdfef6303e1768a079d295e7b66c0d16de897e5ba35deb51a7d2

SHA512
29fa05024bba2c3c8ff7b37be91e67a9582f322858327a48f295cba8931d2842ab4db98e9f9498b8c3a51e5aeb2dacdf02e6195a526639336d90041e42f8c5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2309458.exe

Filesize
390KB

MD5
e646f28ea1f6dff6cf3fb3fe0bf1df0e

SHA1
9dab2697a30318712c67e6cd8060fee4b3867ccb

SHA256
b4e078259f98bdfef6303e1768a079d295e7b66c0d16de897e5ba35deb51a7d2

SHA512
29fa05024bba2c3c8ff7b37be91e67a9582f322858327a48f295cba8931d2842ab4db98e9f9498b8c3a51e5aeb2dacdf02e6195a526639336d90041e42f8c5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3061500.exe

Filesize
356KB

MD5
7c0e5a98bf5cfe59746c757306f12b46

SHA1
5a2bff69dc1d666e68ffc58ecfd27c343e72ad65

SHA256
7dcf5d1686afcebfb18bdd19605d93cbf10380bd85d3b17c7cad20b7fc1b983e

SHA512
15cd4bf2e4b8380b7a9129f9e15df0b68497d7e20c27f486d6395193e7b74aa18fe3440abd0f562592dceb5fd45bedde2183fc7145a535586beb858763defb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g3061500.exe

Filesize
356KB

MD5
7c0e5a98bf5cfe59746c757306f12b46

SHA1
5a2bff69dc1d666e68ffc58ecfd27c343e72ad65

SHA256
7dcf5d1686afcebfb18bdd19605d93cbf10380bd85d3b17c7cad20b7fc1b983e

SHA512
15cd4bf2e4b8380b7a9129f9e15df0b68497d7e20c27f486d6395193e7b74aa18fe3440abd0f562592dceb5fd45bedde2183fc7145a535586beb858763defb74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h6709550.exe

Filesize
174KB

MD5
0f23209595dc4cc7dd0825f23e6fe605

SHA1
79561e9bb71312e926c05181730209abd452dc9d

SHA256
c52cce65014d8cecb5070c528374f48ec638874cf221a115e0e25a813a92f09f

SHA512
a01690376dc7f422b97fcd8061403e5bf1d827d98e49c1fc188de71c00c5dff51ddaa3adf7a33510195df3d094a953fbc58abe8b3f5891ab2dbc386b4b6c69c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h6709550.exe

Filesize
174KB

MD5
0f23209595dc4cc7dd0825f23e6fe605

SHA1
79561e9bb71312e926c05181730209abd452dc9d

SHA256
c52cce65014d8cecb5070c528374f48ec638874cf221a115e0e25a813a92f09f

SHA512
a01690376dc7f422b97fcd8061403e5bf1d827d98e49c1fc188de71c00c5dff51ddaa3adf7a33510195df3d094a953fbc58abe8b3f5891ab2dbc386b4b6c69c4

Download Submit
memory/1580-29-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-30-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-32-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1580-28-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3096-39-0x000000000AF30000-0x000000000B548000-memory.dmp

Filesize
6.1MB

Download
memory/3096-36-0x0000000000BF0000-0x0000000000C20000-memory.dmp

Filesize
192KB

Download
memory/3096-38-0x0000000003080000-0x0000000003086000-memory.dmp

Filesize
24KB

Download
memory/3096-37-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/3096-40-0x000000000AA60000-0x000000000AB6A000-memory.dmp

Filesize
1.0MB

Download
memory/3096-41-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download
memory/3096-42-0x000000000A9A0000-0x000000000A9B2000-memory.dmp

Filesize
72KB

Download
memory/3096-43-0x000000000AA00000-0x000000000AA3C000-memory.dmp

Filesize
240KB

Download
memory/3096-44-0x000000000AB70000-0x000000000ABBC000-memory.dmp

Filesize
304KB

Download
memory/3096-45-0x0000000074020000-0x00000000747D0000-memory.dmp

Filesize
7.7MB

Download
memory/3096-46-0x0000000005580000-0x0000000005590000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads