mystic | 692e82b585be9ac7cc8c88f2eeb475fcf42fed96a7b5572934f45018a5f7f2d1

Analysis

max time kernel
147s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe
Size

604KB
MD5

4a49f25c21c373471295f4badcee8cd5
SHA1

dc1871d02c5f5af9ae2a0e24ff0c1cce6ef48b58
SHA256

17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a
SHA512

95261235a51c77f85d1751907cea517529a9bc6179af76ab2c494ff2f702cf265f8bee8fb60b74ab7bb8094432fa9572bed065078a133480ff3c93069347d69c
SSDEEP

12288:hMray90lso2v9t6ehpXEtFyGjjCYfHGp1Pu5UJK6PYwqbPa3Vr:vySX2v9t6lyGmm5UE6PYPbSB

Score

10^/10

mystic redline mrak infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

mrak

77.91.124.82:19071

Attributes

auth_value
7d9a335ab5dfd42d374867c96fe25302

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral3/files/0x000800000002340a-20.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral3/files/0x000700000002340b-22.dat	family_redline
behavioral3/memory/4004-24-0x0000000000F20000-0x0000000000F50000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
2896	y9132069.exe
772	y5858526.exe
3628	m4249757.exe
4004	n7689082.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5858526.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9132069.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 2896	1016	17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe	82
PID 1016 wrote to memory of 2896	1016	17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe	82
PID 1016 wrote to memory of 2896	1016	17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe	82
PID 2896 wrote to memory of 772	2896	y9132069.exe	83
PID 2896 wrote to memory of 772	2896	y9132069.exe	83
PID 2896 wrote to memory of 772	2896	y9132069.exe	83
PID 772 wrote to memory of 3628	772	y5858526.exe	85
PID 772 wrote to memory of 3628	772	y5858526.exe	85
PID 772 wrote to memory of 3628	772	y5858526.exe	85
PID 772 wrote to memory of 4004	772	y5858526.exe	86
PID 772 wrote to memory of 4004	772	y5858526.exe	86
PID 772 wrote to memory of 4004	772	y5858526.exe	86

C:\Users\Admin\AppData\Local\Temp\17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe
"C:\Users\Admin\AppData\Local\Temp\17a0568b2023370d14f35371e9d7c372589b91d4098eecace76d78c9a7587d3a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9132069.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9132069.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5858526.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5858526.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4249757.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4249757.exe
      4⤵
      Executes dropped EXE
      PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n7689082.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n7689082.exe
      4⤵
      Executes dropped EXE
      PID:4004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9132069.exe

Filesize
502KB

MD5
25e3bca86360bf2bb73c7b70061a59c3

SHA1
1cd97c06a7ccbc2358b98d0bf3af621e908f7e6f

SHA256
647ada02fb7f8a8a7faba9d10d2f777fc67b996528ff6d71abf8a2ea0b834dae

SHA512
27d057942d932005dbfd0ff1a6858e498745213bc180826d72350bc7d0d81845f5620deff3451e821d4dd1646ad4bc5d0b339dd2500f82a30ee64e60ab200ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5858526.exe

Filesize
271KB

MD5
139bb4edad53da946c1a60ea71f03baf

SHA1
59849c83d51d256c2754887d285639bc8573a643

SHA256
05eaf997c36b1e89bff34628335e547b0a9aa8f25865630ee05eeb9bacc07c72

SHA512
22d9b28876fac7d48aaf5fd8e6bdc494acedf510a8bd740a3c85e5ae127148029bb358247c99186f30d4980af4d4f82ad131e74bc42ca38fd469c4a64879805f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m4249757.exe

Filesize
140KB

MD5
c8f4393642b24557d6017f13187f9aae

SHA1
e0a1c6a30b6e231d058203ad23c3e0c354280a86

SHA256
b89c878c7ef7437c591d3879e7f3d78e9219551ad031f749efed6776df808061

SHA512
b42e05231ff54ca16b8d0c5cc88fa9884895d72f987ab8b150e76a6504c62b4c73c6cda84f2a2a78d1d5a529b4b1454a8b527988d227b4daa472af88585982f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n7689082.exe

Filesize
176KB

MD5
f47c0c4e7087bbf69b4cfca759c3d415

SHA1
c330561512ff8cb20054fca477262fa3484294af

SHA256
a53d48e6d0b462026a551feb3535a1a8c76fb0f8a6b482a384e59b1a470ed172

SHA512
29d033c7de833ea20f26ef701681f13ea41a12d00f65a91ed742f3ebb19467ab49fda47ee4c19e89a166566a12a8dab1f533f306271578d9dd5324104fc55176

Download Submit
memory/4004-24-0x0000000000F20000-0x0000000000F50000-memory.dmp

Filesize
192KB

Download
memory/4004-25-0x0000000005940000-0x0000000005946000-memory.dmp

Filesize
24KB

Download
memory/4004-26-0x0000000005FB0000-0x00000000065C8000-memory.dmp

Filesize
6.1MB

Download
memory/4004-27-0x0000000005AB0000-0x0000000005BBA000-memory.dmp

Filesize
1.0MB

Download
memory/4004-28-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/4004-29-0x0000000005A40000-0x0000000005A7C000-memory.dmp

Filesize
240KB

Download
memory/4004-30-0x0000000005BC0000-0x0000000005C0C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads