mystic | 692e82b585be9ac7cc8c88f2eeb475fcf42fed96a7b5572934f45018a5f7f2d1

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe
Size

771KB
MD5

593fd33436446b18f88bd2d596dc126f
SHA1

1ab1f4b4a6057cf0d51780194be0a4358502fa30
SHA256

eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228
SHA512

92c5f75ae577806092ba01d709b498aa122df86d7bcc6b7b15aee4ff1fc84137309a66fd5a6a66ba9f05c44113edffe4aa6fd81e218f8d4121b2dc0ef4680604
SSDEEP

12288:TMrJy90MI57GM5n2MwKciVlDz22oIjdLibc69f44FJ2RHDBUwXpZfSr:Sy3q7GMHfRVlH2IjdO5fHOuwXpZfA

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral17/memory/3760-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral17/memory/3760-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral17/memory/3760-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral17/memory/3760-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2IN840xH.exe	family_redline
behavioral17/memory/1420-22-0x00000000008D0000-0x000000000090E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

de1SU1IX.exe1ZN78Rn2.exe2IN840xH.exe

pid process

3960 de1SU1IX.exe
1260 1ZN78Rn2.exe
1420 2IN840xH.exe

pid	process
3960	de1SU1IX.exe
1260	1ZN78Rn2.exe
1420	2IN840xH.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exede1SU1IX.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	de1SU1IX.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1ZN78Rn2.exe

description pid process target process

PID 1260 set thread context of 3760 1260 1ZN78Rn2.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4432 3760 WerFault.exe AppLaunch.exe
552 1260 WerFault.exe 1ZN78Rn2.exe

description	pid	process	target process
PID 1260 set thread context of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe

pid	pid_target	process	target process
4432	3760	WerFault.exe	AppLaunch.exe
552	1260	WerFault.exe	1ZN78Rn2.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exede1SU1IX.exe1ZN78Rn2.exe

description	pid	process	target process
PID 3012 wrote to memory of 3960	3012	eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe	de1SU1IX.exe
PID 3012 wrote to memory of 3960	3012	eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe	de1SU1IX.exe
PID 3012 wrote to memory of 3960	3012	eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe	de1SU1IX.exe
PID 3960 wrote to memory of 1260	3960	de1SU1IX.exe	1ZN78Rn2.exe
PID 3960 wrote to memory of 1260	3960	de1SU1IX.exe	1ZN78Rn2.exe
PID 3960 wrote to memory of 1260	3960	de1SU1IX.exe	1ZN78Rn2.exe
PID 1260 wrote to memory of 228	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 228	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 228	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 1944	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 1944	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 1944	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 2932	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 2932	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 2932	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 1260 wrote to memory of 3760	1260	1ZN78Rn2.exe	AppLaunch.exe
PID 3960 wrote to memory of 1420	3960	de1SU1IX.exe	2IN840xH.exe
PID 3960 wrote to memory of 1420	3960	de1SU1IX.exe	2IN840xH.exe
PID 3960 wrote to memory of 1420	3960	de1SU1IX.exe	2IN840xH.exe

C:\Users\Admin\AppData\Local\Temp\eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe
"C:\Users\Admin\AppData\Local\Temp\eb7c2e9dc2416d5168ea11cdee85ea662e4aa32921edbe521787e1a7dcc79228.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de1SU1IX.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de1SU1IX.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3960

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1ZN78Rn2.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1ZN78Rn2.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:1944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:2932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 540
5⤵
- Program crash
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1260 -s 604
4⤵
- Program crash
PID:552

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2IN840xH.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2IN840xH.exe
3⤵
- Executes dropped EXE
PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 3760
1⤵
PID:2168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1260 -ip 1260
1⤵
PID:3612

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\de1SU1IX.exe
Filesize
574KB

MD5
56a3533e11d930bb10849c86035a3935

SHA1
1557777bc6b0509ef61d7af2757cc0fe47a272ac

SHA256
04d3cc48c2b6440c24744aa5a39d6d140e9253296dc63fcb36a21768842b14eb

SHA512
676390684bd9743e385b24d38ab9b0c07517a4c99e10ce9136f31a7462af83d73ade0b481627a73c2257a783b960db40b00edfd3a1581233a085eca96ca6a698

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1ZN78Rn2.exe
Filesize
1.1MB

MD5
74417a8688c4f07ac2037c4231a1ebe6

SHA1
7ebfca74ebb71ea19fe9032f50b9ab4b217002bf

SHA256
91fbb98c754b6caf274d397c2e4648d9e0d5ebb873d38d2e20e0dd2bf303255c

SHA512
5ac8d00b56e3ed938e02c90daf2122342b24af653df25a65901372c977134ecdd75d25866a7cd484116a6431b37cc5eb4e077c7c524189cce27e955d8f3329ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2IN840xH.exe
Filesize
223KB

MD5
012a0e4e7350b0c4015dcce14c0f1a85

SHA1
a1f7b888d03e2c4864fbf468c5433f6a9cee2f5b

SHA256
5d6e27320b3a7f6b1072907f3a49cdc961c23e462788f30ad5bd415fdbee2f3f

SHA512
69a503d0968489f93caff3bae0b76c549b8eb21b2ec3c28beded2307fe474b71a377eb61220957cc9a44d696cd1f3f0d83055001a067375ea20971cae42075f3

Download Submit
memory/1420-27-0x0000000008160000-0x000000000826A000-memory.dmp

Filesize
1.0MB

Download
memory/1420-22-0x00000000008D0000-0x000000000090E000-memory.dmp

Filesize
248KB

Download
memory/1420-23-0x0000000007BB0000-0x0000000008154000-memory.dmp

Filesize
5.6MB

Download
memory/1420-24-0x00000000076A0000-0x0000000007732000-memory.dmp

Filesize
584KB

Download
memory/1420-25-0x0000000004C60000-0x0000000004C6A000-memory.dmp

Filesize
40KB

Download
memory/1420-26-0x0000000008780000-0x0000000008D98000-memory.dmp

Filesize
6.1MB

Download
memory/1420-28-0x00000000077C0000-0x00000000077D2000-memory.dmp

Filesize
72KB

Download
memory/1420-29-0x0000000007A90000-0x0000000007ACC000-memory.dmp

Filesize
240KB

Download
memory/1420-30-0x0000000007AD0000-0x0000000007B1C000-memory.dmp

Filesize
304KB

Download
memory/3760-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download