mystic | 8cc6679c34691a07ca82dfa2e42bb4cb80b8f3283bad650d6e3818ac030c32d3

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe
Size

827KB
MD5

bfa4cf5f2fd81a32cb9ef83232c720a5
SHA1

d51afc3ae1d52a7180f052e30b50fbd49041e4db
SHA256

c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297
SHA512

d711132e94eadb471557ed27b962e92e32591aea3e22cbd74207c092da2a55307f0482b8ed711033c4b7213f0c420f78d6f0fb84cdb8eeb8ee5da42997fc2f04
SSDEEP

24576:Yy6WNyEwY8oqPgx/7Qf5kGeLUKhO5U1J9CzyfsO:f6uyEP8oqYx/Uf58PCef

Score

10^/10

mystic redline kendo infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kendo

77.91.124.82:19071

Attributes

auth_value
5a22a881561d49941415902859b51f14

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral16/memory/3960-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral16/memory/3960-23-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral16/memory/3960-25-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral16/memory/3960-22-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral16/files/0x00070000000233ca-27.dat	family_redline
behavioral16/memory/3912-29-0x0000000000260000-0x0000000000290000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
3624	x2790192.exe
2584	x1594632.exe
3720	g5892730.exe
3912	h7023556.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2790192.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x1594632.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3720 set thread context of 3960	3720	g5892730.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4756	3720	WerFault.exe	84

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 3624	2532	c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe	82
PID 2532 wrote to memory of 3624	2532	c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe	82
PID 2532 wrote to memory of 3624	2532	c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe	82
PID 3624 wrote to memory of 2584	3624	x2790192.exe	83
PID 3624 wrote to memory of 2584	3624	x2790192.exe	83
PID 3624 wrote to memory of 2584	3624	x2790192.exe	83
PID 2584 wrote to memory of 3720	2584	x1594632.exe	84
PID 2584 wrote to memory of 3720	2584	x1594632.exe	84
PID 2584 wrote to memory of 3720	2584	x1594632.exe	84
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 3720 wrote to memory of 3960	3720	g5892730.exe	87
PID 2584 wrote to memory of 3912	2584	x1594632.exe	92
PID 2584 wrote to memory of 3912	2584	x1594632.exe	92
PID 2584 wrote to memory of 3912	2584	x1594632.exe	92

C:\Users\Admin\AppData\Local\Temp\c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe
"C:\Users\Admin\AppData\Local\Temp\c1f424012a2d01ca458f9aa1aee9cfff75d79a0d7398ed9d13463a386f0c9297.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2790192.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2790192.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1594632.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1594632.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5892730.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5892730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3720
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3960
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3720 -s 572
        5⤵
        Program crash
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h7023556.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h7023556.exe
      4⤵
      Executes dropped EXE
      PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3720 -ip 3720
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2790192.exe

Filesize
556KB

MD5
ab353ab8395136ce3c214ebd8e8b74e5

SHA1
103db4ed2ff9b5296ffae98a797a122a050ffc60

SHA256
351faf7ade9423e3056a77dca69892082a8e30ad2389789858fe874f64925256

SHA512
352216fdaf6686c402a6979e654a5cda635a1787170c219f6589e33a2eed83a3665e03f1d36f7f1c2971c59ef51c66b779b212a7eaf02b23ab2b1f1934eb5fc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1594632.exe

Filesize
390KB

MD5
db43c539d38e0bc63a2849e4415aefee

SHA1
749d0e1d77da28ed864525f0e0999af9c9a71a03

SHA256
6c88d6864ac21b191dcba056eadae954f32a7e758412250ab70a83e94414a045

SHA512
5a9194e554303c9d41c72fc2c7712056d5d68283f7fcd1a0041cfa30621519f8f69baca1b8f39755c9fb111235c234e17c6607c98d71b1294e0918e55f22ad81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5892730.exe

Filesize
364KB

MD5
19622df5eda5bd2c71ee8000dee836e6

SHA1
d73854203c08104994cdbe9b46b1403df7777624

SHA256
56ac3827460e328e4359dd7483371cd550d271776e14708403888130375fd115

SHA512
c7cbeb39c4e7c941715455124c102abab12f64f724c6e81ef9fdd5692873c15a18f7684066e11e0a845a40bf6e31898c23f65ec47d74b0aff0464fb53abbd9a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\h7023556.exe

Filesize
174KB

MD5
ae141dfba399b606555b9acacfc8eb94

SHA1
7759ea1d7052da3aa2b2efad1badeee9a9e69d96

SHA256
096844ac923777fb50381ec3a2be5258af7b1ede272f2af05a789ec6bb173eda

SHA512
35a47d6135d7cdb1d069c4d5c8e5f24daf180e7976196220f3cda72e57fa228f74d4784787b241dcff4f1fb911102fc1279a645e65e0ff95af682ee7c38a8bda

Download Submit
memory/3912-32-0x000000000A110000-0x000000000A21A000-memory.dmp

Filesize
1.0MB

Download
memory/3912-35-0x0000000002480000-0x00000000024CC000-memory.dmp

Filesize
304KB

Download
memory/3912-34-0x000000000A080000-0x000000000A0BC000-memory.dmp

Filesize
240KB

Download
memory/3912-33-0x000000000A020000-0x000000000A032000-memory.dmp

Filesize
72KB

Download
memory/3912-29-0x0000000000260000-0x0000000000290000-memory.dmp

Filesize
192KB

Download
memory/3912-30-0x0000000000CA0000-0x0000000000CA6000-memory.dmp

Filesize
24KB

Download
memory/3912-31-0x000000000A620000-0x000000000AC38000-memory.dmp

Filesize
6.1MB

Download
memory/3960-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3960-22-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3960-25-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3960-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads