mystic | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe
Size

1.5MB
MD5

cac5297462d6e1dfd40d458d6d59823f
SHA1

0d28c9fa7ead0dda4e3e50d50ad2261bafbc541f
SHA256

7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc
SHA512

b04ee15a4124fc1efa31e8ee73eb36676db44e5d5f4f7c6db807f846efb7ca9e3f5686e3a77f40253f5c84b910ba80219c7d1c5f1d61e7e2ff62e63fe5c4109d
SSDEEP

24576:myzAp59zdpCTo+EZ9GucVMfluA40tD+RS8JW8VhpvQlzLHkx4hfO2P8Cyp:1y7CMlGuIF4rNqS9HkKhfO2P4

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral13/memory/4092-35-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral13/memory/4092-38-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral13/memory/4092-40-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe	family_redline
behavioral13/memory/900-42-0x00000000006E0000-0x000000000071E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

hQ8Vs3Nx.exesg0Nc9eD.exeQE4gf9zN.exeOk5Lc0Vf.exe1sr67Cy1.exe2RB567CG.exe

pid process

3732 hQ8Vs3Nx.exe
2988 sg0Nc9eD.exe
1592 QE4gf9zN.exe
1220 Ok5Lc0Vf.exe
1700 1sr67Cy1.exe
900 2RB567CG.exe

pid	process
3732	hQ8Vs3Nx.exe
2988	sg0Nc9eD.exe
1592	QE4gf9zN.exe
1220	Ok5Lc0Vf.exe
1700	1sr67Cy1.exe
900	2RB567CG.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

hQ8Vs3Nx.exesg0Nc9eD.exeQE4gf9zN.exeOk5Lc0Vf.exe7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hQ8Vs3Nx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	sg0Nc9eD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	QE4gf9zN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ok5Lc0Vf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1sr67Cy1.exe

description pid process target process

PID 1700 set thread context of 4092 1700 1sr67Cy1.exe AppLaunch.exe

description	pid	process	target process
PID 1700 set thread context of 4092	1700	1sr67Cy1.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exehQ8Vs3Nx.exesg0Nc9eD.exeQE4gf9zN.exeOk5Lc0Vf.exe1sr67Cy1.exe

description	pid	process	target process
PID 1448 wrote to memory of 3732	1448	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe	hQ8Vs3Nx.exe
PID 1448 wrote to memory of 3732	1448	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe	hQ8Vs3Nx.exe
PID 1448 wrote to memory of 3732	1448	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe	hQ8Vs3Nx.exe
PID 3732 wrote to memory of 2988	3732	hQ8Vs3Nx.exe	sg0Nc9eD.exe
PID 3732 wrote to memory of 2988	3732	hQ8Vs3Nx.exe	sg0Nc9eD.exe
PID 3732 wrote to memory of 2988	3732	hQ8Vs3Nx.exe	sg0Nc9eD.exe
PID 2988 wrote to memory of 1592	2988	sg0Nc9eD.exe	QE4gf9zN.exe
PID 2988 wrote to memory of 1592	2988	sg0Nc9eD.exe	QE4gf9zN.exe
PID 2988 wrote to memory of 1592	2988	sg0Nc9eD.exe	QE4gf9zN.exe
PID 1592 wrote to memory of 1220	1592	QE4gf9zN.exe	Ok5Lc0Vf.exe
PID 1592 wrote to memory of 1220	1592	QE4gf9zN.exe	Ok5Lc0Vf.exe
PID 1592 wrote to memory of 1220	1592	QE4gf9zN.exe	Ok5Lc0Vf.exe
PID 1220 wrote to memory of 1700	1220	Ok5Lc0Vf.exe	1sr67Cy1.exe
PID 1220 wrote to memory of 1700	1220	Ok5Lc0Vf.exe	1sr67Cy1.exe
PID 1220 wrote to memory of 1700	1220	Ok5Lc0Vf.exe	1sr67Cy1.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1700 wrote to memory of 4092	1700	1sr67Cy1.exe	AppLaunch.exe
PID 1220 wrote to memory of 900	1220	Ok5Lc0Vf.exe	2RB567CG.exe
PID 1220 wrote to memory of 900	1220	Ok5Lc0Vf.exe	2RB567CG.exe
PID 1220 wrote to memory of 900	1220	Ok5Lc0Vf.exe	2RB567CG.exe

C:\Users\Admin\AppData\Local\Temp\7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe
"C:\Users\Admin\AppData\Local\Temp\7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1448

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hQ8Vs3Nx.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hQ8Vs3Nx.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3732

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sg0Nc9eD.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sg0Nc9eD.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2988

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QE4gf9zN.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QE4gf9zN.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1592

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok5Lc0Vf.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok5Lc0Vf.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1220

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sr67Cy1.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sr67Cy1.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:4092

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe
6⤵
- Executes dropped EXE
PID:900

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hQ8Vs3Nx.exe
Filesize
1.3MB

MD5
a36fd34b3d1b0ef884d7a55853358dcc

SHA1
9f78c85b459ee10a98f2cb0b8988828e20ceb7b4

SHA256
1c1cc41665e96fc1fb4b14af2fd17b422183a500757945f6289a4befcb4d8720

SHA512
72fa624a5a4d5b29055b190ee1ec5524da16a30d0c2e65d87734772a80387b6acc864961f566996581864ce131b450ffef416145670d138ed309dbdaa3125949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sg0Nc9eD.exe
Filesize
1.1MB

MD5
2acb13262419ce51d3b332e5add0a38d

SHA1
7a72b35842fe8dfb1fbc36a1eaa4c15932c00bd5

SHA256
5517bacaca963a51d0d6eee94edd89bce5dc353bdce5215f6c7cf7d5069c63de

SHA512
1b5ac26d870a5b1d552452620a1e459f1081fc0fdd21560898470269b640ee219b423bba1db4fac26401885a8150cdd1c7a9fccf9c4d6838b8e78dcacf8c9bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QE4gf9zN.exe
Filesize
759KB

MD5
aa1f1a243e1c643d3628a1d03fe3dfe5

SHA1
9a7e886e9cf0a312e98a6ec70f2d2a67eb9ac486

SHA256
781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754

SHA512
eb319b6eeefc62ca9da42ac8a8b935988dd8f850fc0c02000dc08c4e56e8b9cd27dbdea3eef713a2c45a381c57add3fca4dd3d79663b888b4462c76929cc1337

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok5Lc0Vf.exe
Filesize
563KB

MD5
138c33958320e3e3a0f6d4d48eabcd47

SHA1
159ead1f9c8b9614c303d8949e0110ac4deaa307

SHA256
4a09067f906ac2830ba540f4a4d674b6dc0740aa443514c0c9b4387976626272

SHA512
fc9f213afea7cd839ab684cba872b30bbb1ee360d4a388876897fddcc6c3c5043ed8f222bce37bbac6dec24b9d0573947016c9d557dbd053357656f2389b735d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sr67Cy1.exe
Filesize
1.1MB

MD5
ab206af415ba79326b5e785a1712fb9a

SHA1
e99bf49b1ea7e4bbb48fb404782b2934ca36717a

SHA256
cf50c17b31a2dc71085471d09dd2bbbb4123507a00f4515d9095c25391088839

SHA512
20e0f019ae11d2e96590f89a9b947995032b510d40b647c8162ebbf6a563f381fa42a8fe70fe01c473bae8abcd4b80c60c7a5d116e52bee98cfa8a786de83b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe
Filesize
221KB

MD5
3ef4b51b9e3ae103caa495e11923ad05

SHA1
bd868fd3bc00b77e6fc0a884b13152692ffb93e5

SHA256
78cd14290f7c3802dafe46bc63dd3de21340f691a6ab760fe337ac6c316bdc0a

SHA512
09aad3c71276f54f4c2401aeb66ad6960f5a68de4a38d8c815d08dbd410ee475ec14f1e5ea7b4679ca73b0b42e83ccc7ff840738fb7418ed0c2133822f161d77

Download Submit
memory/900-45-0x0000000004A50000-0x0000000004A5A000-memory.dmp

Filesize
40KB

Download
memory/900-42-0x00000000006E0000-0x000000000071E000-memory.dmp

Filesize
248KB

Download
memory/900-43-0x00000000079B0000-0x0000000007F54000-memory.dmp

Filesize
5.6MB

Download
memory/900-44-0x00000000074A0000-0x0000000007532000-memory.dmp

Filesize
584KB

Download
memory/900-46-0x0000000008580000-0x0000000008B98000-memory.dmp

Filesize
6.1MB

Download
memory/900-47-0x0000000008070000-0x000000000817A000-memory.dmp

Filesize
1.0MB

Download
memory/900-48-0x00000000075D0000-0x00000000075E2000-memory.dmp

Filesize
72KB

Download
memory/900-49-0x0000000007660000-0x000000000769C000-memory.dmp

Filesize
240KB

Download
memory/900-50-0x00000000078D0000-0x000000000791C000-memory.dmp

Filesize
304KB

Download
memory/4092-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4092-35-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download