mystic | 8f7ecfcea350d8e91e6bb9083833f37b57aa78d15022b68c407055e2463bd982

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe
Size

759KB
MD5

aa1f1a243e1c643d3628a1d03fe3dfe5
SHA1

9a7e886e9cf0a312e98a6ec70f2d2a67eb9ac486
SHA256

781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754
SHA512

eb319b6eeefc62ca9da42ac8a8b935988dd8f850fc0c02000dc08c4e56e8b9cd27dbdea3eef713a2c45a381c57add3fca4dd3d79663b888b4462c76929cc1337
SSDEEP

12288:zMrxy90kdsZQT9R4xmy3mv88YzniUK2WsJ/wt17qS20y353p6ua4En6oxOcKmRgt:iytT9o7Wtu9WsJ30yJ3lXmJxq5

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral9/memory/1368-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral9/memory/1368-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral9/memory/1368-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral9/memory/1368-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral9/files/0x0007000000023436-20.dat	family_redline
behavioral9/memory/3320-22-0x0000000000D30000-0x0000000000D6E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
3188	Ok5Lc0Vf.exe
696	1sr67Cy1.exe
3320	2RB567CG.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ok5Lc0Vf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 1368	696	1sr67Cy1.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1368	WerFault.exe	88

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 3188	3788	781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe	83
PID 3788 wrote to memory of 3188	3788	781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe	83
PID 3788 wrote to memory of 3188	3788	781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe	83
PID 3188 wrote to memory of 696	3188	Ok5Lc0Vf.exe	84
PID 3188 wrote to memory of 696	3188	Ok5Lc0Vf.exe	84
PID 3188 wrote to memory of 696	3188	Ok5Lc0Vf.exe	84
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 696 wrote to memory of 1368	696	1sr67Cy1.exe	88
PID 3188 wrote to memory of 3320	3188	Ok5Lc0Vf.exe	90
PID 3188 wrote to memory of 3320	3188	Ok5Lc0Vf.exe	90
PID 3188 wrote to memory of 3320	3188	Ok5Lc0Vf.exe	90

C:\Users\Admin\AppData\Local\Temp\781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe
"C:\Users\Admin\AppData\Local\Temp\781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ok5Lc0Vf.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ok5Lc0Vf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3188
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sr67Cy1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sr67Cy1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:696
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1368
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1368 -s 540
        5⤵
        Program crash
        
        PID:4624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2RB567CG.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2RB567CG.exe
    3⤵
    - Executes dropped EXE
    PID:3320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1368 -ip 1368
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ok5Lc0Vf.exe

Filesize
563KB

MD5
138c33958320e3e3a0f6d4d48eabcd47

SHA1
159ead1f9c8b9614c303d8949e0110ac4deaa307

SHA256
4a09067f906ac2830ba540f4a4d674b6dc0740aa443514c0c9b4387976626272

SHA512
fc9f213afea7cd839ab684cba872b30bbb1ee360d4a388876897fddcc6c3c5043ed8f222bce37bbac6dec24b9d0573947016c9d557dbd053357656f2389b735d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1sr67Cy1.exe

Filesize
1.1MB

MD5
ab206af415ba79326b5e785a1712fb9a

SHA1
e99bf49b1ea7e4bbb48fb404782b2934ca36717a

SHA256
cf50c17b31a2dc71085471d09dd2bbbb4123507a00f4515d9095c25391088839

SHA512
20e0f019ae11d2e96590f89a9b947995032b510d40b647c8162ebbf6a563f381fa42a8fe70fe01c473bae8abcd4b80c60c7a5d116e52bee98cfa8a786de83b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2RB567CG.exe

Filesize
221KB

MD5
3ef4b51b9e3ae103caa495e11923ad05

SHA1
bd868fd3bc00b77e6fc0a884b13152692ffb93e5

SHA256
78cd14290f7c3802dafe46bc63dd3de21340f691a6ab760fe337ac6c316bdc0a

SHA512
09aad3c71276f54f4c2401aeb66ad6960f5a68de4a38d8c815d08dbd410ee475ec14f1e5ea7b4679ca73b0b42e83ccc7ff840738fb7418ed0c2133822f161d77

Download Submit
memory/1368-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1368-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1368-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1368-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3320-23-0x00000000080E0000-0x0000000008684000-memory.dmp

Filesize
5.6MB

Download
memory/3320-22-0x0000000000D30000-0x0000000000D6E000-memory.dmp

Filesize
248KB

Download
memory/3320-24-0x0000000007C30000-0x0000000007CC2000-memory.dmp

Filesize
584KB

Download
memory/3320-25-0x00000000051D0000-0x00000000051DA000-memory.dmp

Filesize
40KB

Download
memory/3320-26-0x0000000008CB0000-0x00000000092C8000-memory.dmp

Filesize
6.1MB

Download
memory/3320-27-0x0000000007F80000-0x000000000808A000-memory.dmp

Filesize
1.0MB

Download
memory/3320-28-0x0000000007E20000-0x0000000007E32000-memory.dmp

Filesize
72KB

Download
memory/3320-29-0x0000000007E80000-0x0000000007EBC000-memory.dmp

Filesize
240KB

Download
memory/3320-30-0x0000000007EC0000-0x0000000007F0C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads