mystic | cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d

Analysis

max time kernel
169s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe
Size

929KB
MD5

8c1cbbe3e2da4c16e2b7ff14afed2eab
SHA1

bc5970573f300823ab8d541d12473e5b09726fc8
SHA256

cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d
SHA512

cfaaaf148e5132467a27106aee11811636c31e26d32f537463f5295230c40bbcb776b608f1d32433f3b5204a4ba86e4bd49ba172f7d9926f4809f13cbe681ad8
SSDEEP

24576:2yBTSyLMaN8IiW/UcBQGF3UHbXmY0EkE7iRE:FkyAaN8IigUcL67mLET7

Score

10^/10

mystic redline kendo infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kendo

77.91.124.82:19071

Attributes

auth_value
5a22a881561d49941415902859b51f14

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3828-28-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3828-29-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3828-30-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3828-32-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Executes dropped EXE 5 IoCs

pid	Process
4460	x1278018.exe
4704	x7483394.exe
2276	x2145209.exe
2004	g8597052.exe
1988	h2320972.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x1278018.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x7483394.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x2145209.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2004 set thread context of 3828	2004	g8597052.exe	92

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4104	2004	WerFault.exe	90
3444	3828	WerFault.exe	92

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 4460	640	cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe	86
PID 640 wrote to memory of 4460	640	cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe	86
PID 640 wrote to memory of 4460	640	cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe	86
PID 4460 wrote to memory of 4704	4460	x1278018.exe	88
PID 4460 wrote to memory of 4704	4460	x1278018.exe	88
PID 4460 wrote to memory of 4704	4460	x1278018.exe	88
PID 4704 wrote to memory of 2276	4704	x7483394.exe	89
PID 4704 wrote to memory of 2276	4704	x7483394.exe	89
PID 4704 wrote to memory of 2276	4704	x7483394.exe	89
PID 2276 wrote to memory of 2004	2276	x2145209.exe	90
PID 2276 wrote to memory of 2004	2276	x2145209.exe	90
PID 2276 wrote to memory of 2004	2276	x2145209.exe	90
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2004 wrote to memory of 3828	2004	g8597052.exe	92
PID 2276 wrote to memory of 1988	2276	x2145209.exe	99
PID 2276 wrote to memory of 1988	2276	x2145209.exe	99
PID 2276 wrote to memory of 1988	2276	x2145209.exe	99

C:\Users\Admin\AppData\Local\Temp\cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe
"C:\Users\Admin\AppData\Local\Temp\cafb76f9643b63e652262f519ad4074d7f73659e727ffe711db74d96fceaed4d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1278018.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1278018.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4460
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7483394.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7483394.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2145209.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2145209.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8597052.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8597052.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2004
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 540
        7⤵
        Program crash
        
        PID:3444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 552
        6⤵
        Program crash
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2320972.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2320972.exe
        5⤵
        Executes dropped EXE
        
        PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2004 -ip 2004
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3828 -ip 3828
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1278018.exe

Filesize
828KB

MD5
cafdfbb08a1be235ca8f9c4abc761008

SHA1
090b51e36efa8cd21a9826203cffb7cba64a4819

SHA256
b8045802be8f490a3a323a604419237c5f00f1b872e876a5abed1a20cff455ea

SHA512
e4b7f5316179cd8cac4f09d1e1f5a2174550d4c9fbbf93d118cf4b1f4e58219627b360de0fb787a20a2249437b75dd65acf4cf43c48eee431c0548ff4811ac15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x1278018.exe

Filesize
828KB

MD5
cafdfbb08a1be235ca8f9c4abc761008

SHA1
090b51e36efa8cd21a9826203cffb7cba64a4819

SHA256
b8045802be8f490a3a323a604419237c5f00f1b872e876a5abed1a20cff455ea

SHA512
e4b7f5316179cd8cac4f09d1e1f5a2174550d4c9fbbf93d118cf4b1f4e58219627b360de0fb787a20a2249437b75dd65acf4cf43c48eee431c0548ff4811ac15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7483394.exe

Filesize
556KB

MD5
d777f8dd404abf92c90df16686e02ab2

SHA1
7d40746477c400fd65d2902e3cc3942a9b8340c2

SHA256
4f3764684fd70e5d08e84201250d0c1577e770bfdfcfb6c656d4087d33a0a954

SHA512
05ed6a2a67f2542461087f1e91372eaf343aaa7fe4db26c1d39c51b73623f67b75e4b7e4802d64dbf9a4660caa12b9909221cd7018f0b62c96c371950e2268f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x7483394.exe

Filesize
556KB

MD5
d777f8dd404abf92c90df16686e02ab2

SHA1
7d40746477c400fd65d2902e3cc3942a9b8340c2

SHA256
4f3764684fd70e5d08e84201250d0c1577e770bfdfcfb6c656d4087d33a0a954

SHA512
05ed6a2a67f2542461087f1e91372eaf343aaa7fe4db26c1d39c51b73623f67b75e4b7e4802d64dbf9a4660caa12b9909221cd7018f0b62c96c371950e2268f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2145209.exe

Filesize
390KB

MD5
676a319af738abd3650500c3feb227e9

SHA1
e49481ea929c853074b5c30e98c4770894040f66

SHA256
9cce1b36dd5debe6a24ecc08219729d47e3b65b0182d2c6c96cdc59b41eb1aac

SHA512
015ff70467f6fefba73bc69eaa2a5b283018e0397fa2cb306b2c5ad593c38968d1f0d272ff0aa312956f35b4ae1ca8ef7fc221821fa30a99ef27b3441be02d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x2145209.exe

Filesize
390KB

MD5
676a319af738abd3650500c3feb227e9

SHA1
e49481ea929c853074b5c30e98c4770894040f66

SHA256
9cce1b36dd5debe6a24ecc08219729d47e3b65b0182d2c6c96cdc59b41eb1aac

SHA512
015ff70467f6fefba73bc69eaa2a5b283018e0397fa2cb306b2c5ad593c38968d1f0d272ff0aa312956f35b4ae1ca8ef7fc221821fa30a99ef27b3441be02d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8597052.exe

Filesize
364KB

MD5
73ad870f90b06d1dad29e2d1cc039a69

SHA1
d2a3aeed95c23f5094452a3d452c21b76b501c50

SHA256
2cefd9cc06ead7eb56ba7f7c8ef885e89d3273fc55bd51cd7abc77a092284857

SHA512
7a972ced7db38f76eda38e1811bbd996619a6b9287733ed190138be132e24249c3a2640f75facf4b9665aeacd20adc11b5b7ceb6d35b179192a1630ec184805c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g8597052.exe

Filesize
364KB

MD5
73ad870f90b06d1dad29e2d1cc039a69

SHA1
d2a3aeed95c23f5094452a3d452c21b76b501c50

SHA256
2cefd9cc06ead7eb56ba7f7c8ef885e89d3273fc55bd51cd7abc77a092284857

SHA512
7a972ced7db38f76eda38e1811bbd996619a6b9287733ed190138be132e24249c3a2640f75facf4b9665aeacd20adc11b5b7ceb6d35b179192a1630ec184805c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2320972.exe

Filesize
173KB

MD5
d95599dc9d92a556ec9db33966bf0c0d

SHA1
11a098acf78cfe80b8071437ce1b9d5359aeb2d9

SHA256
8c57c8647b22c25fd63959a27af3c837905f653894ea2ef1793782371413f432

SHA512
5f68466a6d95d247637a9b11f646afc08d89af735d0c1029b926479364e8f00de5e294c3e5fb4d9075869d3541e08e9ebae91dcf7c23e28ac94701703e358ae6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2320972.exe

Filesize
173KB

MD5
d95599dc9d92a556ec9db33966bf0c0d

SHA1
11a098acf78cfe80b8071437ce1b9d5359aeb2d9

SHA256
8c57c8647b22c25fd63959a27af3c837905f653894ea2ef1793782371413f432

SHA512
5f68466a6d95d247637a9b11f646afc08d89af735d0c1029b926479364e8f00de5e294c3e5fb4d9075869d3541e08e9ebae91dcf7c23e28ac94701703e358ae6

Download Submit
memory/1988-39-0x000000000B1C0000-0x000000000B7D8000-memory.dmp

Filesize
6.1MB

Download
memory/1988-42-0x000000000AC50000-0x000000000AC62000-memory.dmp

Filesize
72KB

Download
memory/1988-46-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/1988-45-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/1988-36-0x0000000074B10000-0x00000000752C0000-memory.dmp

Filesize
7.7MB

Download
memory/1988-37-0x0000000000D60000-0x0000000000D90000-memory.dmp

Filesize
192KB

Download
memory/1988-44-0x000000000AE20000-0x000000000AE6C000-memory.dmp

Filesize
304KB

Download
memory/1988-40-0x000000000AD10000-0x000000000AE1A000-memory.dmp

Filesize
1.0MB

Download
memory/1988-38-0x00000000056C0000-0x00000000056C6000-memory.dmp

Filesize
24KB

Download
memory/1988-41-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/1988-43-0x000000000ACB0000-0x000000000ACEC000-memory.dmp

Filesize
240KB

Download
memory/3828-29-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-32-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-30-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3828-28-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads