mystic | 8f7ecfcea350d8e91e6bb9083833f37b57aa78d15022b68c407055e2463bd982

Analysis

max time kernel
133s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
Size

761KB
MD5

05d9d7be64bbf82f6d363494fdf307ff
SHA1

f707a315b91d16adcae27d23b44e04ddb8416e9a
SHA256

9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937
SHA512

95c08f4ee99c6d2c6824378cc356cd9d32db6c380e2cc25f90ca31ffd6030d81dcb2a31939a17e5980898f0100491903eeac23bf8e96df3611b23458526a5b80
SSDEEP

12288:qMr/y900kfIXRO68a220RojTx7cl6ozZ0QXhWQGe9q5j9vmWJjiD5c3hjDh:FyafIhO687Ro5mzZgQGe9q99mWJQ23hB

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral12/memory/1264-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral12/memory/1264-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral12/memory/1264-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral12/memory/1264-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x000700000002346f-20.dat	family_redline
behavioral12/memory/748-22-0x00000000001F0000-0x000000000022E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2448	Ke1xb1RP.exe
3752	1YX43JV5.exe
748	2Gk178jR.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ke1xb1RP.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3752 set thread context of 1264	3752	1YX43JV5.exe	90

Program crash 1 IoCs

pid	pid_target	Process
1440	1264	WerFault.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2448	5044	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe	85
PID 5044 wrote to memory of 2448	5044	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe	85
PID 5044 wrote to memory of 2448	5044	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe	85
PID 2448 wrote to memory of 3752	2448	Ke1xb1RP.exe	86
PID 2448 wrote to memory of 3752	2448	Ke1xb1RP.exe	86
PID 2448 wrote to memory of 3752	2448	Ke1xb1RP.exe	86
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 3752 wrote to memory of 1264	3752	1YX43JV5.exe	90
PID 2448 wrote to memory of 748	2448	Ke1xb1RP.exe	91
PID 2448 wrote to memory of 748	2448	Ke1xb1RP.exe	91
PID 2448 wrote to memory of 748	2448	Ke1xb1RP.exe	91

C:\Users\Admin\AppData\Local\Temp\9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
"C:\Users\Admin\AppData\Local\Temp\9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1xb1RP.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1xb1RP.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1YX43JV5.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1YX43JV5.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1264
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 540
        5⤵
        Program crash
        
        PID:1440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe
    3⤵
    - Executes dropped EXE
    PID:748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1264 -ip 1264
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1xb1RP.exe

Filesize
565KB

MD5
8a5058319396cc2592bff6232e98e9e9

SHA1
f317e992cfaeebe34cc7119fd46aaf9e6af86094

SHA256
ebad21eb8e8a6a9f835dac9f2c6edd4da2a160344206dfbb096534d6eb14e13f

SHA512
8461347c6e3b37d30271e6c792914850d35f7a37da11c8b04838f41777de0f67c5403627ce167b33a17a9419c63b0b4dfc7cf60ffe0b5167777fcca6760e4e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1YX43JV5.exe

Filesize
1.1MB

MD5
76512cba15406e69473041693b81fd5f

SHA1
a8d7f17170d5f1a9d4d74674ed64303e0857021f

SHA256
51ec25ae087e7783638803a2269b2639f9c82f5463822fa8b245a5c4d7c53880

SHA512
96219dbd070fd102e86c7da74ecc6f4ef5bcf84393225d1e02b76914f3d54e15f96a627e8ebbf9f8eecff703ffbd2e742c1e0724acbfb3008e5fe323e9e76442

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe

Filesize
222KB

MD5
027b8446e48b9b0a3d8a4ebe6d508b24

SHA1
93fb5dc0bd8a0607bd7d1ef76475b92f2eca7174

SHA256
e9091302035e9877ce65c5ee2c8671061530de92f48fa6095785a01b93455b27

SHA512
2afc347a61c2b5a7a86b6aa459977f511ccf40573e5bd4b37acdb6d8c49ab4e8df0a621f305a8674e11b6ec83a35cc227fa99c2f22536c2c83cdc8d36734f0cb

Download Submit
memory/748-28-0x00000000072F0000-0x0000000007302000-memory.dmp

Filesize
72KB

Download
memory/748-22-0x00000000001F0000-0x000000000022E000-memory.dmp

Filesize
248KB

Download
memory/748-23-0x0000000007620000-0x0000000007BC4000-memory.dmp

Filesize
5.6MB

Download
memory/748-24-0x0000000007110000-0x00000000071A2000-memory.dmp

Filesize
584KB

Download
memory/748-25-0x0000000004710000-0x000000000471A000-memory.dmp

Filesize
40KB

Download
memory/748-26-0x00000000081F0000-0x0000000008808000-memory.dmp

Filesize
6.1MB

Download
memory/748-29-0x0000000007350000-0x000000000738C000-memory.dmp

Filesize
240KB

Download
memory/748-27-0x0000000007480000-0x000000000758A000-memory.dmp

Filesize
1.0MB

Download
memory/748-30-0x0000000007390000-0x00000000073DC000-memory.dmp

Filesize
304KB

Download
memory/1264-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1264-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1264-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1264-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads