mystic | 0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7

Analysis

max time kernel
140s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2023, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe
Size 522KB
Sample231111-mnfqfadf7x
SHA256 0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7
MD5 8c1baa8bea7fd113ff351ead4d6b5291
SHA1 43c9e99978d00c3959c36c30976296ffd9fdb70e
SHA512 5359041ecab6b75773db47b3ff620da50bd1f42c241092d5261ffef135cd54d42f8ce7d9a9590d64b7d78ca97ec768ae4f8d24cac0f5a0ed522415ae823095b6
SSDEEP 12288:0MrFy90XU5ZTbS4UFcZRS5I84Bh9M6bJF:5yd3S42ceT4ZXJF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline taiga infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/2296-14-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2296-16-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2296-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2296-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/2756-22-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	7UP7FG39.exe

Executes dropped EXE 4 IoCs

pid	Process
2244	XN5Oj25.exe
2240	1xd48KX1.exe
4704	2vK4661.exe
228	7UP7FG39.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	XN5Oj25.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2240 set thread context of 2296	2240	1xd48KX1.exe	92
PID 4704 set thread context of 2756	4704	2vK4661.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1336	2296	WerFault.exe	92

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 2244	2024	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe	87
PID 2024 wrote to memory of 2244	2024	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe	87
PID 2024 wrote to memory of 2244	2024	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe	87
PID 2244 wrote to memory of 2240	2244	XN5Oj25.exe	88
PID 2244 wrote to memory of 2240	2244	XN5Oj25.exe	88
PID 2244 wrote to memory of 2240	2244	XN5Oj25.exe	88
PID 2240 wrote to memory of 4736	2240	1xd48KX1.exe	91
PID 2240 wrote to memory of 4736	2240	1xd48KX1.exe	91
PID 2240 wrote to memory of 4736	2240	1xd48KX1.exe	91
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2240 wrote to memory of 2296	2240	1xd48KX1.exe	92
PID 2244 wrote to memory of 4704	2244	XN5Oj25.exe	95
PID 2244 wrote to memory of 4704	2244	XN5Oj25.exe	95
PID 2244 wrote to memory of 4704	2244	XN5Oj25.exe	95
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 4704 wrote to memory of 2756	4704	2vK4661.exe	99
PID 2024 wrote to memory of 228	2024	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe	100
PID 2024 wrote to memory of 228	2024	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe	100
PID 2024 wrote to memory of 228	2024	NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe	100
PID 228 wrote to memory of 2788	228	7UP7FG39.exe	102
PID 228 wrote to memory of 2788	228	7UP7FG39.exe	102
PID 228 wrote to memory of 2788	228	7UP7FG39.exe	102

C:\Users\Admin\AppData\Local\Temp\NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0d72f00195531961afb7f8503e4d958638db654537f09a9239c64427bdc0d7a7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XN5Oj25.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XN5Oj25.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1xd48KX1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1xd48KX1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4736
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 564
        5⤵
        Program crash
        
        PID:1336
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2vK4661.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2vK4661.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2756
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7UP7FG39.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7UP7FG39.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
    3⤵
    PID:2788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2296 -ip 2296
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7UP7FG39.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7UP7FG39.exe
Size 73KB
SHA256 f1cf682377e954a5bfc2d9bf4f15b00f8b44ed5014220004d84aa5148919abb1
MD5 3adaaa9511a337b19fc152ebef907118
SHA1 c3cc1e58236517c445d7e53386f20bb53bb2c340
SHA512 3d915e71f0cb9d35d94ca7fcf807081f89a758eb6b9b8f61bcce4ac36ba221ea2409ddc58dc006a1c85e88ec01d12d772e8554520d6fcadbb95ec77d2f365e92
SSDEEP 1536:5bIqfS0bO7B7wTewJk9WeBLYVrx8AA0oL:5Rfet7wTewJk9lSCj0oL
MD5 SHA1 SHA512 SSDEEP

Submit Download

7UP7FG39.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7UP7FG39.exe
Size 73KB
SHA256 f1cf682377e954a5bfc2d9bf4f15b00f8b44ed5014220004d84aa5148919abb1
MD5 3adaaa9511a337b19fc152ebef907118
SHA1 c3cc1e58236517c445d7e53386f20bb53bb2c340
SHA512 3d915e71f0cb9d35d94ca7fcf807081f89a758eb6b9b8f61bcce4ac36ba221ea2409ddc58dc006a1c85e88ec01d12d772e8554520d6fcadbb95ec77d2f365e92
SSDEEP 1536:5bIqfS0bO7B7wTewJk9WeBLYVrx8AA0oL:5Rfet7wTewJk9lSCj0oL
MD5 SHA1 SHA512 SSDEEP

Submit Download

XN5Oj25.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XN5Oj25.exe
Size 400KB
SHA256 3f9ae44a76cb3b7f14083f821f6581d302241388b0dbe91f7a7ee8e67bb45a15
MD5 e09413d7c011377798d6ff65e555a2df
SHA1 df4dee8c2070ac0ebfaebc134f4776672573d589
SHA512 4228fbb9ac63f897a5637326269b76ba8146a492ebe5f42e8d804c603b2f44aaa7b6bc8bc3456d17a9f020ebd6f84182c82f3bb404e057736329ab260c5932bf
SSDEEP 6144:Key+bnr+4p0yN90QEIMw4UFYvVSlvUdgqA5OLQJsN7Gm7n6QzrOIPR:WMrsy9044UF3viS5OL4knHzqIPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

XN5Oj25.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XN5Oj25.exe
Size 400KB
SHA256 3f9ae44a76cb3b7f14083f821f6581d302241388b0dbe91f7a7ee8e67bb45a15
MD5 e09413d7c011377798d6ff65e555a2df
SHA1 df4dee8c2070ac0ebfaebc134f4776672573d589
SHA512 4228fbb9ac63f897a5637326269b76ba8146a492ebe5f42e8d804c603b2f44aaa7b6bc8bc3456d17a9f020ebd6f84182c82f3bb404e057736329ab260c5932bf
SSDEEP 6144:Key+bnr+4p0yN90QEIMw4UFYvVSlvUdgqA5OLQJsN7Gm7n6QzrOIPR:WMrsy9044UF3viS5OL4knHzqIPR
MD5 SHA1 SHA512 SSDEEP

Submit Download

1xd48KX1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1xd48KX1.exe
Size 319KB
SHA256 bda2de9cf44b5c317144c8eef0e229740fda2b537e8c233c1d2117c6942ac3ee
MD5 4a868c16482f0ab8800d3f1eff627a9b
SHA1 c4527bdfb9929627534ca2299d858757e243bbe2
SHA512 cc1cfeb3591ecb3d48783f5710dc0bbbe03273f778cec76ba42eb3194f6f8b84e100f73b8ba4fdab49c1c626ac73006de62d327ec5759c0015e1895456f12f10
SSDEEP 6144:LwPgXtnEpBXYKEnPLxQNRufSkV0lRRkfIHpEH63LOVmTP0+79vdzZ4HySPr/4L:LwPgXtnGALxYRuft0lR+fIHpEH63LOVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

1xd48KX1.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1xd48KX1.exe
Size 319KB
SHA256 bda2de9cf44b5c317144c8eef0e229740fda2b537e8c233c1d2117c6942ac3ee
MD5 4a868c16482f0ab8800d3f1eff627a9b
SHA1 c4527bdfb9929627534ca2299d858757e243bbe2
SHA512 cc1cfeb3591ecb3d48783f5710dc0bbbe03273f778cec76ba42eb3194f6f8b84e100f73b8ba4fdab49c1c626ac73006de62d327ec5759c0015e1895456f12f10
SSDEEP 6144:LwPgXtnEpBXYKEnPLxQNRufSkV0lRRkfIHpEH63LOVmTP0+79vdzZ4HySPr/4L:LwPgXtnGALxYRuft0lR+fIHpEH63LOVK
MD5 SHA1 SHA512 SSDEEP

Submit Download

2vK4661.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2vK4661.exe
Size 358KB
SHA256 9a95829eba3e8339105c40f90d76b506f3c0233b4dbb0d1f568815f0395baa00
MD5 aa5b30ef8e986f9b233400c5f7924667
SHA1 005f7a369fa56c5783bd346c4abca2e07071e7b6
SHA512 c80dc9aeb2dc2bcb603bd7e2325fda1ce73dd3d1b055546dadf5b6972126d905db03e4a5d6a595630dd2176a4efe70cd0c77d20960728d37483643d0a298bc03
SSDEEP 6144:CUPgXtnEpBXYKETxc94FpXHrBdddT00Y16JzcLVm/hSq5ykvbHDZSPr/4L:CUPgXtnGU5dA0Y16xvbjZSPr/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

2vK4661.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2vK4661.exe
Size 358KB
SHA256 9a95829eba3e8339105c40f90d76b506f3c0233b4dbb0d1f568815f0395baa00
MD5 aa5b30ef8e986f9b233400c5f7924667
SHA1 005f7a369fa56c5783bd346c4abca2e07071e7b6
SHA512 c80dc9aeb2dc2bcb603bd7e2325fda1ce73dd3d1b055546dadf5b6972126d905db03e4a5d6a595630dd2176a4efe70cd0c77d20960728d37483643d0a298bc03
SSDEEP 6144:CUPgXtnEpBXYKETxc94FpXHrBdddT00Y16JzcLVm/hSq5ykvbHDZSPr/4L:CUPgXtnGU5dA0Y16xvbjZSPr/i
MD5 SHA1 SHA512 SSDEEP

Submit Download

is64.bat

Path C:\Users\Admin\AppData\Local\Temp\is64.bat
Size 181B
SHA256 e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559
MD5 225edee1d46e0a80610db26b275d72fb
SHA1 ce206abf11aaf19278b72f5021cc64b1b427b7e8
SHA512 4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504
MD5 SHA1 SHA512

Submit Download

is64.txt

Path C:\Users\Admin\AppData\Local\Temp\is64.txt
Size 3B
SHA256 f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04
MD5 a5ea0ad9260b1550a14cc58d2c39b03d
SHA1 f0aedf295071ed34ab8c6a7692223d22b6a19841
SHA512 7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74
MD5 SHA1 SHA512

Submit Download

memory/2296-16-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2296-18-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2296-15-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2296-14-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/2756-30-0x00000000082B0000-0x0000000008854000-memory.dmp

Download

memory/2756-31-0x0000000007DA0000-0x0000000007E32000-memory.dmp

Download

memory/2756-33-0x0000000007F30000-0x0000000007F40000-memory.dmp

Download

memory/2756-22-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2756-28-0x0000000074540000-0x0000000074CF0000-memory.dmp

Download

memory/2756-38-0x0000000007E60000-0x0000000007E6A000-memory.dmp

Download

memory/2756-39-0x0000000008E80000-0x0000000009498000-memory.dmp

Download

memory/2756-40-0x0000000008140000-0x000000000824A000-memory.dmp

Download

memory/2756-41-0x0000000008050000-0x0000000008062000-memory.dmp

Download

memory/2756-42-0x00000000080B0000-0x00000000080EC000-memory.dmp

Download

memory/2756-43-0x00000000080F0000-0x000000000813C000-memory.dmp

Download

memory/2756-44-0x0000000074540000-0x0000000074CF0000-memory.dmp

Download

memory/2756-45-0x0000000007F30000-0x0000000007F40000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads