mystic | fb68898fc1ee1968d2f438649408cbb8854551c7efa6458a5175c462f02fda63

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe
Size

1.5MB
MD5

cac5297462d6e1dfd40d458d6d59823f
SHA1

0d28c9fa7ead0dda4e3e50d50ad2261bafbc541f
SHA256

7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc
SHA512

b04ee15a4124fc1efa31e8ee73eb36676db44e5d5f4f7c6db807f846efb7ca9e3f5686e3a77f40253f5c84b910ba80219c7d1c5f1d61e7e2ff62e63fe5c4109d
SSDEEP

24576:myzAp59zdpCTo+EZ9GucVMfluA40tD+RS8JW8VhpvQlzLHkx4hfO2P8Cyp:1y7CMlGuIF4rNqS9HkKhfO2P4

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral13/memory/3652-35-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral13/memory/3652-36-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral13/memory/3652-38-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral13/files/0x0007000000023430-40.dat	family_redline
behavioral13/memory/2476-42-0x0000000000300000-0x000000000033E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
1936	hQ8Vs3Nx.exe
4420	sg0Nc9eD.exe
4328	QE4gf9zN.exe
1256	Ok5Lc0Vf.exe
1356	1sr67Cy1.exe
2476	2RB567CG.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	hQ8Vs3Nx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	sg0Nc9eD.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	QE4gf9zN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ok5Lc0Vf.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1356 set thread context of 3652	1356	1sr67Cy1.exe	92

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 1936	5100	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe	82
PID 5100 wrote to memory of 1936	5100	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe	82
PID 5100 wrote to memory of 1936	5100	7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe	82
PID 1936 wrote to memory of 4420	1936	hQ8Vs3Nx.exe	83
PID 1936 wrote to memory of 4420	1936	hQ8Vs3Nx.exe	83
PID 1936 wrote to memory of 4420	1936	hQ8Vs3Nx.exe	83
PID 4420 wrote to memory of 4328	4420	sg0Nc9eD.exe	84
PID 4420 wrote to memory of 4328	4420	sg0Nc9eD.exe	84
PID 4420 wrote to memory of 4328	4420	sg0Nc9eD.exe	84
PID 4328 wrote to memory of 1256	4328	QE4gf9zN.exe	85
PID 4328 wrote to memory of 1256	4328	QE4gf9zN.exe	85
PID 4328 wrote to memory of 1256	4328	QE4gf9zN.exe	85
PID 1256 wrote to memory of 1356	1256	Ok5Lc0Vf.exe	86
PID 1256 wrote to memory of 1356	1256	Ok5Lc0Vf.exe	86
PID 1256 wrote to memory of 1356	1256	Ok5Lc0Vf.exe	86
PID 1356 wrote to memory of 4984	1356	1sr67Cy1.exe	90
PID 1356 wrote to memory of 4984	1356	1sr67Cy1.exe	90
PID 1356 wrote to memory of 4984	1356	1sr67Cy1.exe	90
PID 1356 wrote to memory of 2968	1356	1sr67Cy1.exe	91
PID 1356 wrote to memory of 2968	1356	1sr67Cy1.exe	91
PID 1356 wrote to memory of 2968	1356	1sr67Cy1.exe	91
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1356 wrote to memory of 3652	1356	1sr67Cy1.exe	92
PID 1256 wrote to memory of 2476	1256	Ok5Lc0Vf.exe	93
PID 1256 wrote to memory of 2476	1256	Ok5Lc0Vf.exe	93
PID 1256 wrote to memory of 2476	1256	Ok5Lc0Vf.exe	93

C:\Users\Admin\AppData\Local\Temp\7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe
"C:\Users\Admin\AppData\Local\Temp\7c1372b4b0e76a7d202143cbcc40dce411a401341f2168aef3204cfc9f9da9fc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hQ8Vs3Nx.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hQ8Vs3Nx.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sg0Nc9eD.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sg0Nc9eD.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QE4gf9zN.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QE4gf9zN.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok5Lc0Vf.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok5Lc0Vf.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sr67Cy1.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sr67Cy1.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4984
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2968
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe
        6⤵
        Executes dropped EXE
        
        PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\hQ8Vs3Nx.exe

Filesize
1.3MB

MD5
a36fd34b3d1b0ef884d7a55853358dcc

SHA1
9f78c85b459ee10a98f2cb0b8988828e20ceb7b4

SHA256
1c1cc41665e96fc1fb4b14af2fd17b422183a500757945f6289a4befcb4d8720

SHA512
72fa624a5a4d5b29055b190ee1ec5524da16a30d0c2e65d87734772a80387b6acc864961f566996581864ce131b450ffef416145670d138ed309dbdaa3125949

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sg0Nc9eD.exe

Filesize
1.1MB

MD5
2acb13262419ce51d3b332e5add0a38d

SHA1
7a72b35842fe8dfb1fbc36a1eaa4c15932c00bd5

SHA256
5517bacaca963a51d0d6eee94edd89bce5dc353bdce5215f6c7cf7d5069c63de

SHA512
1b5ac26d870a5b1d552452620a1e459f1081fc0fdd21560898470269b640ee219b423bba1db4fac26401885a8150cdd1c7a9fccf9c4d6838b8e78dcacf8c9bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\QE4gf9zN.exe

Filesize
759KB

MD5
aa1f1a243e1c643d3628a1d03fe3dfe5

SHA1
9a7e886e9cf0a312e98a6ec70f2d2a67eb9ac486

SHA256
781c022afdd03ecc97a7195986c14b7a81fc5a02d1b0e8c7561a1a1ff3406754

SHA512
eb319b6eeefc62ca9da42ac8a8b935988dd8f850fc0c02000dc08c4e56e8b9cd27dbdea3eef713a2c45a381c57add3fca4dd3d79663b888b4462c76929cc1337

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ok5Lc0Vf.exe

Filesize
563KB

MD5
138c33958320e3e3a0f6d4d48eabcd47

SHA1
159ead1f9c8b9614c303d8949e0110ac4deaa307

SHA256
4a09067f906ac2830ba540f4a4d674b6dc0740aa443514c0c9b4387976626272

SHA512
fc9f213afea7cd839ab684cba872b30bbb1ee360d4a388876897fddcc6c3c5043ed8f222bce37bbac6dec24b9d0573947016c9d557dbd053357656f2389b735d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sr67Cy1.exe

Filesize
1.1MB

MD5
ab206af415ba79326b5e785a1712fb9a

SHA1
e99bf49b1ea7e4bbb48fb404782b2934ca36717a

SHA256
cf50c17b31a2dc71085471d09dd2bbbb4123507a00f4515d9095c25391088839

SHA512
20e0f019ae11d2e96590f89a9b947995032b510d40b647c8162ebbf6a563f381fa42a8fe70fe01c473bae8abcd4b80c60c7a5d116e52bee98cfa8a786de83b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RB567CG.exe

Filesize
221KB

MD5
3ef4b51b9e3ae103caa495e11923ad05

SHA1
bd868fd3bc00b77e6fc0a884b13152692ffb93e5

SHA256
78cd14290f7c3802dafe46bc63dd3de21340f691a6ab760fe337ac6c316bdc0a

SHA512
09aad3c71276f54f4c2401aeb66ad6960f5a68de4a38d8c815d08dbd410ee475ec14f1e5ea7b4679ca73b0b42e83ccc7ff840738fb7418ed0c2133822f161d77

Download Submit
memory/2476-42-0x0000000000300000-0x000000000033E000-memory.dmp

Filesize
248KB

Download
memory/2476-43-0x0000000007650000-0x0000000007BF4000-memory.dmp

Filesize
5.6MB

Download
memory/2476-44-0x0000000007140000-0x00000000071D2000-memory.dmp

Filesize
584KB

Download
memory/2476-45-0x0000000002500000-0x000000000250A000-memory.dmp

Filesize
40KB

Download
memory/2476-46-0x0000000008220000-0x0000000008838000-memory.dmp

Filesize
6.1MB

Download
memory/2476-47-0x0000000007460000-0x000000000756A000-memory.dmp

Filesize
1.0MB

Download
memory/2476-48-0x0000000007120000-0x0000000007132000-memory.dmp

Filesize
72KB

Download
memory/2476-49-0x0000000007350000-0x000000000738C000-memory.dmp

Filesize
240KB

Download
memory/2476-50-0x00000000072E0000-0x000000000732C000-memory.dmp

Filesize
304KB

Download
memory/3652-36-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3652-38-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3652-35-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads