mystic | 4d201919a0ebca66c9444a66f9324fb870e4af25252f27aa405255cca0167379

Analysis

max time kernel
142s
max time network
177s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
60b345feed921142d86737e3c6897b0f.exe
Size 896KB
Sample231114-lycabsbe26
SHA256 4d201919a0ebca66c9444a66f9324fb870e4af25252f27aa405255cca0167379
MD5 60b345feed921142d86737e3c6897b0f
SHA1 34956700dd049b0d91cad261f0053aa14a2c95a0
SHA512 456da362b0f0825b3219f4913d209a4fe931d643ebce0eb985205b6f1b3c1da93ab11a88f49da2433d55f925848dd8668f83a8e9eb1c9867fd73888f64355e16
SSDEEP 12288:+MrHy90LW8MrTI+xEBRju2M4iFA1ejxeeuzxQikhOEufTJlnGYJjr6bycGDTFyQs:5yFI+xmju2gO4KQ9hfqzHgy0Qpyo8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline taiga infostealer persistence spyware stealer

Malware Config

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/3940-21-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/3940-25-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/3940-23-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/3940-22-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/432-14-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
2240	JB3MI50.exe
2852	11ph5847.exe
3640	12qc250.exe
4936	13ZX560.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	60b345feed921142d86737e3c6897b0f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	JB3MI50.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2852 set thread context of 432	2852	11ph5847.exe	97
PID 3640 set thread context of 3940	3640	12qc250.exe	104
PID 4936 set thread context of 1536	4936	13ZX560.exe	116

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1660	3940	WerFault.exe	104
1436	3940	WerFault.exe	104

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2240	1548	60b345feed921142d86737e3c6897b0f.exe	93
PID 1548 wrote to memory of 2240	1548	60b345feed921142d86737e3c6897b0f.exe	93
PID 1548 wrote to memory of 2240	1548	60b345feed921142d86737e3c6897b0f.exe	93
PID 2240 wrote to memory of 2852	2240	JB3MI50.exe	94
PID 2240 wrote to memory of 2852	2240	JB3MI50.exe	94
PID 2240 wrote to memory of 2852	2240	JB3MI50.exe	94
PID 2852 wrote to memory of 3100	2852	11ph5847.exe	96
PID 2852 wrote to memory of 3100	2852	11ph5847.exe	96
PID 2852 wrote to memory of 3100	2852	11ph5847.exe	96
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2852 wrote to memory of 432	2852	11ph5847.exe	97
PID 2240 wrote to memory of 3640	2240	JB3MI50.exe	98
PID 2240 wrote to memory of 3640	2240	JB3MI50.exe	98
PID 2240 wrote to memory of 3640	2240	JB3MI50.exe	98
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 3640 wrote to memory of 3940	3640	12qc250.exe	104
PID 1548 wrote to memory of 4936	1548	60b345feed921142d86737e3c6897b0f.exe	106
PID 1548 wrote to memory of 4936	1548	60b345feed921142d86737e3c6897b0f.exe	106
PID 1548 wrote to memory of 4936	1548	60b345feed921142d86737e3c6897b0f.exe	106
PID 3940 wrote to memory of 1660	3940	AppLaunch.exe	112
PID 3940 wrote to memory of 1660	3940	AppLaunch.exe	112
PID 3940 wrote to memory of 1660	3940	AppLaunch.exe	112
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116
PID 4936 wrote to memory of 1536	4936	13ZX560.exe	116

C:\Users\Admin\AppData\Local\Temp\60b345feed921142d86737e3c6897b0f.exe
"C:\Users\Admin\AppData\Local\Temp\60b345feed921142d86737e3c6897b0f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JB3MI50.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JB3MI50.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11ph5847.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11ph5847.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3100
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:432
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12qc250.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12qc250.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 560
        5⤵
        Program crash
        
        PID:1660
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 560
        5⤵
        Program crash
        
        PID:1436
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13ZX560.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13ZX560.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3940 -ip 3940
1⤵
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13ZX560.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13ZX560.exe
Size 724KB
SHA256 8f30df64ccfc0b40f146ac1c690410810b05859091ea5eee0cdfefebe18c8411
MD5 737e2205c3ae1d658bd7ee6f4194d143
SHA1 30a221a649e66bebb709e7cdf9aa7bcedc7c0c50
SHA512 32959ab0c4f23e4f08889164f95a71eff0a521033b3fab3725ba7c83dd5c4c07aca80f7285b5e3f676b0df283de2cd8081c01f3eb378d57371a6421a9729d4d6
SSDEEP 12288:Gk+F2wcch8Ndql04RrJEg7wN5kzC8posv8PDLGXZqm/res/Io2:/+8lcly9KzC8+sSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

13ZX560.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\13ZX560.exe
Size 724KB
SHA256 8f30df64ccfc0b40f146ac1c690410810b05859091ea5eee0cdfefebe18c8411
MD5 737e2205c3ae1d658bd7ee6f4194d143
SHA1 30a221a649e66bebb709e7cdf9aa7bcedc7c0c50
SHA512 32959ab0c4f23e4f08889164f95a71eff0a521033b3fab3725ba7c83dd5c4c07aca80f7285b5e3f676b0df283de2cd8081c01f3eb378d57371a6421a9729d4d6
SSDEEP 12288:Gk+F2wcch8Ndql04RrJEg7wN5kzC8posv8PDLGXZqm/res/Io2:/+8lcly9KzC8+sSI
MD5 SHA1 SHA512 SSDEEP

Submit Download

JB3MI50.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JB3MI50.exe
Size 432KB
SHA256 83b97fbe288d3032c0278b4e821cb9b25f483e19da891503c10f9bcb7d2db0e2
MD5 4f3458f4049ed931f8731f873585c32f
SHA1 cac5f40b05b973bea5a0236d24172b025dcaec1f
SHA512 bf424aad78225eae0e743dd5702c089fe02be0bd653d53e8595b5779d9985f4b50587f1d3543634f8e548ca9b5afa9962942d36ec20ebe087824ce5a15f490f7
SSDEEP 12288:3Mr8y90ihuf4oambrxT/Tfvwa2A1GjG6V:/yvhuwoambrN7Xw2Yz
MD5 SHA1 SHA512 SSDEEP

Submit Download

JB3MI50.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\JB3MI50.exe
Size 432KB
SHA256 83b97fbe288d3032c0278b4e821cb9b25f483e19da891503c10f9bcb7d2db0e2
MD5 4f3458f4049ed931f8731f873585c32f
SHA1 cac5f40b05b973bea5a0236d24172b025dcaec1f
SHA512 bf424aad78225eae0e743dd5702c089fe02be0bd653d53e8595b5779d9985f4b50587f1d3543634f8e548ca9b5afa9962942d36ec20ebe087824ce5a15f490f7
SSDEEP 12288:3Mr8y90ihuf4oambrxT/Tfvwa2A1GjG6V:/yvhuwoambrN7Xw2Yz
MD5 SHA1 SHA512 SSDEEP

Submit Download

11ph5847.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11ph5847.exe
Size 415KB
SHA256 143613d5bc6133bc163519b6868180f90c24ad5d91b575439a4d96aad706e3d4
MD5 d326755bd6fcd9287551f4c44db72950
SHA1 b27aa4d54c88da8a91538a2bb31e004ad605390a
SHA512 8591d5b7837204672cb8bdaab95c408b73a0c23b3772b581eeb4e9ad15ffb22a74626fdff8b0c7724e5691a004b437ece09db6409a45ec676d035a1273090b0b
SSDEEP 6144:9LIU/FKe4lNUq/Vr58AOL0HVnP5RNfC+BAxC0ApoeFa+gJlgWZY1xFLvTaRLKgyX:GU9KeIB58KF2+ey5Qt29uE
MD5 SHA1 SHA512 SSDEEP

Submit Download

11ph5847.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\11ph5847.exe
Size 415KB
SHA256 143613d5bc6133bc163519b6868180f90c24ad5d91b575439a4d96aad706e3d4
MD5 d326755bd6fcd9287551f4c44db72950
SHA1 b27aa4d54c88da8a91538a2bb31e004ad605390a
SHA512 8591d5b7837204672cb8bdaab95c408b73a0c23b3772b581eeb4e9ad15ffb22a74626fdff8b0c7724e5691a004b437ece09db6409a45ec676d035a1273090b0b
SSDEEP 6144:9LIU/FKe4lNUq/Vr58AOL0HVnP5RNfC+BAxC0ApoeFa+gJlgWZY1xFLvTaRLKgyX:GU9KeIB58KF2+ey5Qt29uE
MD5 SHA1 SHA512 SSDEEP

Submit Download

12qc250.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12qc250.exe
Size 378KB
SHA256 e74b19f6d3fd7a4eb825e83da412fc76b3483955140f8f1d914b383f49d8f7dd
MD5 163a39059ae5add2c01ccde6696f254d
SHA1 fb612437360dab5ca795e2b816cc55adad5e521c
SHA512 4830880925816533d83a0835fc963f8a4147adbadc1be0c9322032ddbc5561af01846951d5a51efc70cc73b072f15da71a7d0a26c6b216dad741d65d59dcc0f3
SSDEEP 6144:u5ykMFF2Wb2U4nDjcAO8RHokUZ3YlY+NBsowF/6/uSx0OVzr3vCC:pk+F2wcck7lY6Bs1FS/BtZ/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

12qc250.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\12qc250.exe
Size 378KB
SHA256 e74b19f6d3fd7a4eb825e83da412fc76b3483955140f8f1d914b383f49d8f7dd
MD5 163a39059ae5add2c01ccde6696f254d
SHA1 fb612437360dab5ca795e2b816cc55adad5e521c
SHA512 4830880925816533d83a0835fc963f8a4147adbadc1be0c9322032ddbc5561af01846951d5a51efc70cc73b072f15da71a7d0a26c6b216dad741d65d59dcc0f3
SSDEEP 6144:u5ykMFF2Wb2U4nDjcAO8RHokUZ3YlY+NBsowF/6/uSx0OVzr3vCC:pk+F2wcck7lY6Bs1FS/BtZ/x
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-18-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

memory/432-38-0x00000000089E0000-0x0000000008FF8000-memory.dmp

Download

memory/432-42-0x00000000083C0000-0x000000000840C000-memory.dmp

Download

memory/432-41-0x0000000007AC0000-0x0000000007AFC000-memory.dmp

Download

memory/432-40-0x0000000002C10000-0x0000000002C22000-memory.dmp

Download

memory/432-39-0x00000000084D0000-0x00000000085DA000-memory.dmp

Download

memory/432-19-0x0000000007E10000-0x00000000083B4000-memory.dmp

Download

memory/432-14-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/432-30-0x0000000007900000-0x0000000007910000-memory.dmp

Download

memory/432-29-0x00000000744A0000-0x0000000074C50000-memory.dmp

Download

memory/432-31-0x0000000007AB0000-0x0000000007ABA000-memory.dmp

Download

memory/432-20-0x0000000007940000-0x00000000079D2000-memory.dmp

Download

memory/432-34-0x0000000007900000-0x0000000007910000-memory.dmp

Download

memory/1536-33-0x0000000000400000-0x0000000000488000-memory.dmp

Download

memory/1536-35-0x0000000000400000-0x0000000000488000-memory.dmp

Download

memory/1536-37-0x0000000000400000-0x0000000000488000-memory.dmp

Download

memory/1536-32-0x0000000000400000-0x0000000000488000-memory.dmp

Download

memory/3940-22-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3940-23-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3940-25-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/3940-21-0x0000000000400000-0x0000000000434000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads