mystic | ac90002ec144a6c8c89c45137265a202aeef6b583cef01223b622e10b4c4b797

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe
Size

769KB
MD5

eeec40b56c7b6d71e6358b192d6014ea
SHA1

e84410a95d5ee36604cefcb9c1f2131e6f2fdb30
SHA256

ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871
SHA512

c4b4029b9a8d3897e4cde70b08848db822c22b3dd6cee1430c51775723fae43fa42c4f21ebb51c8a26a91cd303f09b7641c3e2c0710b9ef7a64d56f8d2f84466
SSDEEP

12288:EMrqy90Q6rN3FQYzBc1j0wEP3FqbRG9RvhejcxWvDxh0cN3dbzap6Fk66pz7fbdt:OysHQ2Bc1jfM2DD1XbzMek6adt

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral15/memory/3204-14-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral15/memory/3204-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral15/memory/3204-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral15/memory/3204-17-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2OV204LT.exe	family_redline
behavioral15/memory/4648-22-0x00000000006D0000-0x000000000070E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

ed2Tf1HK.exe1lD37FZ3.exe2OV204LT.exe

pid process

1116 ed2Tf1HK.exe
1456 1lD37FZ3.exe
4648 2OV204LT.exe

pid	process
1116	ed2Tf1HK.exe
1456	1lD37FZ3.exe
4648	2OV204LT.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exeed2Tf1HK.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ed2Tf1HK.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1lD37FZ3.exe

description pid process target process

PID 1456 set thread context of 3204 1456 1lD37FZ3.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4004 3204 WerFault.exe AppLaunch.exe
2444 1456 WerFault.exe 1lD37FZ3.exe

description	pid	process	target process
PID 1456 set thread context of 3204	1456	1lD37FZ3.exe	AppLaunch.exe

pid	pid_target	process	target process
4004	3204	WerFault.exe	AppLaunch.exe
2444	1456	WerFault.exe	1lD37FZ3.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exeed2Tf1HK.exe1lD37FZ3.exe

description	pid	process	target process
PID 4068 wrote to memory of 1116	4068	ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe	ed2Tf1HK.exe
PID 4068 wrote to memory of 1116	4068	ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe	ed2Tf1HK.exe
PID 4068 wrote to memory of 1116	4068	ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe	ed2Tf1HK.exe
PID 1116 wrote to memory of 1456	1116	ed2Tf1HK.exe	1lD37FZ3.exe
PID 1116 wrote to memory of 1456	1116	ed2Tf1HK.exe	1lD37FZ3.exe
PID 1116 wrote to memory of 1456	1116	ed2Tf1HK.exe	1lD37FZ3.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1456 wrote to memory of 3204	1456	1lD37FZ3.exe	AppLaunch.exe
PID 1116 wrote to memory of 4648	1116	ed2Tf1HK.exe	2OV204LT.exe
PID 1116 wrote to memory of 4648	1116	ed2Tf1HK.exe	2OV204LT.exe
PID 1116 wrote to memory of 4648	1116	ed2Tf1HK.exe	2OV204LT.exe

C:\Users\Admin\AppData\Local\Temp\ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe
"C:\Users\Admin\AppData\Local\Temp\ba6bca4989ecb1792e703ed9fe411faf649a4dcb4d05d319ac2678201fd51871.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4068

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ed2Tf1HK.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ed2Tf1HK.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1116

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1lD37FZ3.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1lD37FZ3.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:3204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 540
5⤵
- Program crash
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 572
4⤵
- Program crash
PID:2444

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2OV204LT.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2OV204LT.exe
3⤵
- Executes dropped EXE
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 3204 -ip 3204
1⤵
PID:2716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1456 -ip 1456
1⤵
PID:1412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ed2Tf1HK.exe
Filesize
573KB

MD5
acd2429173096a7f9f51a06f57949ba0

SHA1
abad9dea3d1680c5ccb587843e594f61add88153

SHA256
c65106e265e3bf05f2085634f891d46cad67eb335cd0afeadb8f982902f2860c

SHA512
409f4fe3b94c7e39a9321fe9699cd8c80fe2583b5c1036be543f4efe2ae2045f5653fff5f79a856288fce900b857ce4f11186828920dfaf10868a3ce16d64eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1lD37FZ3.exe
Filesize
1.1MB

MD5
c8aecb8d6bbe196e860d63eb69f76265

SHA1
be6a6abb8c3b5e632b721d26a9fb40d531220fd2

SHA256
5e81b717e25ec26d38e98dda09476a083f8df44a996730bc6911411e6d4fc371

SHA512
fa24dafc07cb9cc71ba5744e676d6eb7f923be096639b3b692aafe2879795c208629af54edfaa8281c23af630a34c2e63574b6ea1822c5af094503b4270a8f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2OV204LT.exe
Filesize
223KB

MD5
cef356684cf562b1f06ed37e9c087574

SHA1
245dd6099aefe31599b52efc88977c392662e2ef

SHA256
14d07eff82ff0bf2f4d532c84e941e8d828a14e57292348db6fd7322907885e7

SHA512
a00db02ef155c2e1b6ba041c56965b8be24d49cbb87a8d3c0e10fd177a1943073f39c300b2632b339b0bdb7dab8407246e3be9a004cf083dbcd10a1712f75067

Download Submit
memory/3204-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3204-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3204-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3204-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-23-0x00000000079B0000-0x0000000007F54000-memory.dmp

Filesize
5.6MB

Download
memory/4648-22-0x00000000006D0000-0x000000000070E000-memory.dmp

Filesize
248KB

Download
memory/4648-24-0x00000000074A0000-0x0000000007532000-memory.dmp

Filesize
584KB

Download
memory/4648-25-0x0000000007640000-0x000000000764A000-memory.dmp

Filesize
40KB

Download
memory/4648-26-0x0000000008580000-0x0000000008B98000-memory.dmp

Filesize
6.1MB

Download
memory/4648-27-0x0000000007F60000-0x000000000806A000-memory.dmp

Filesize
1.0MB

Download
memory/4648-28-0x0000000005010000-0x0000000005022000-memory.dmp

Filesize
72KB

Download
memory/4648-29-0x00000000076A0000-0x00000000076DC000-memory.dmp

Filesize
240KB

Download
memory/4648-30-0x0000000007830000-0x000000000787C000-memory.dmp

Filesize
304KB

Download