mystic | 8f7ecfcea350d8e91e6bb9083833f37b57aa78d15022b68c407055e2463bd982

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 19:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
Size

761KB
MD5

05d9d7be64bbf82f6d363494fdf307ff
SHA1

f707a315b91d16adcae27d23b44e04ddb8416e9a
SHA256

9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937
SHA512

95c08f4ee99c6d2c6824378cc356cd9d32db6c380e2cc25f90ca31ffd6030d81dcb2a31939a17e5980898f0100491903eeac23bf8e96df3611b23458526a5b80
SSDEEP

12288:qMr/y900kfIXRO68a220RojTx7cl6ozZ0QXhWQGe9q5j9vmWJjiD5c3hjDh:FyafIhO687Ro5mzZgQGe9q99mWJQ23hB

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral12/memory/4080-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral12/memory/4080-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral12/memory/4080-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral12/memory/4080-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe	family_redline
behavioral12/memory/3912-22-0x00000000005B0000-0x00000000005EE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

Ke1xb1RP.exe1YX43JV5.exe2Gk178jR.exe

pid process

3100 Ke1xb1RP.exe
2760 1YX43JV5.exe
3912 2Gk178jR.exe

pid	process
3100	Ke1xb1RP.exe
2760	1YX43JV5.exe
3912	2Gk178jR.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exeKe1xb1RP.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ke1xb1RP.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1YX43JV5.exe

description pid process target process

PID 2760 set thread context of 4080 2760 1YX43JV5.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2844 4080 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2760 set thread context of 4080	2760	1YX43JV5.exe	AppLaunch.exe

pid	pid_target	process	target process
2844	4080	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exeKe1xb1RP.exe1YX43JV5.exe

description	pid	process	target process
PID 1100 wrote to memory of 3100	1100	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe	Ke1xb1RP.exe
PID 1100 wrote to memory of 3100	1100	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe	Ke1xb1RP.exe
PID 1100 wrote to memory of 3100	1100	9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe	Ke1xb1RP.exe
PID 3100 wrote to memory of 2760	3100	Ke1xb1RP.exe	1YX43JV5.exe
PID 3100 wrote to memory of 2760	3100	Ke1xb1RP.exe	1YX43JV5.exe
PID 3100 wrote to memory of 2760	3100	Ke1xb1RP.exe	1YX43JV5.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 2760 wrote to memory of 4080	2760	1YX43JV5.exe	AppLaunch.exe
PID 3100 wrote to memory of 3912	3100	Ke1xb1RP.exe	2Gk178jR.exe
PID 3100 wrote to memory of 3912	3100	Ke1xb1RP.exe	2Gk178jR.exe
PID 3100 wrote to memory of 3912	3100	Ke1xb1RP.exe	2Gk178jR.exe

C:\Users\Admin\AppData\Local\Temp\9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe
"C:\Users\Admin\AppData\Local\Temp\9a3023ff334b34f4bea043eedeced95c41485b4799d3c2d56c0cb04b60143937.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1100

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1xb1RP.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1xb1RP.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3100

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1YX43JV5.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1YX43JV5.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 540
5⤵
- Program crash
PID:2844

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe
3⤵
- Executes dropped EXE
PID:3912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4080 -ip 4080
1⤵
PID:4792

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1xb1RP.exe
Filesize
565KB

MD5
8a5058319396cc2592bff6232e98e9e9

SHA1
f317e992cfaeebe34cc7119fd46aaf9e6af86094

SHA256
ebad21eb8e8a6a9f835dac9f2c6edd4da2a160344206dfbb096534d6eb14e13f

SHA512
8461347c6e3b37d30271e6c792914850d35f7a37da11c8b04838f41777de0f67c5403627ce167b33a17a9419c63b0b4dfc7cf60ffe0b5167777fcca6760e4e1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1YX43JV5.exe
Filesize
1.1MB

MD5
76512cba15406e69473041693b81fd5f

SHA1
a8d7f17170d5f1a9d4d74674ed64303e0857021f

SHA256
51ec25ae087e7783638803a2269b2639f9c82f5463822fa8b245a5c4d7c53880

SHA512
96219dbd070fd102e86c7da74ecc6f4ef5bcf84393225d1e02b76914f3d54e15f96a627e8ebbf9f8eecff703ffbd2e742c1e0724acbfb3008e5fe323e9e76442

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Gk178jR.exe
Filesize
222KB

MD5
027b8446e48b9b0a3d8a4ebe6d508b24

SHA1
93fb5dc0bd8a0607bd7d1ef76475b92f2eca7174

SHA256
e9091302035e9877ce65c5ee2c8671061530de92f48fa6095785a01b93455b27

SHA512
2afc347a61c2b5a7a86b6aa459977f511ccf40573e5bd4b37acdb6d8c49ab4e8df0a621f305a8674e11b6ec83a35cc227fa99c2f22536c2c83cdc8d36734f0cb

Download Submit
memory/3912-27-0x0000000007650000-0x000000000775A000-memory.dmp

Filesize
1.0MB

Download
memory/3912-22-0x00000000005B0000-0x00000000005EE000-memory.dmp

Filesize
248KB

Download
memory/3912-23-0x0000000007800000-0x0000000007DA4000-memory.dmp

Filesize
5.6MB

Download
memory/3912-24-0x0000000007330000-0x00000000073C2000-memory.dmp

Filesize
584KB

Download
memory/3912-25-0x0000000002780000-0x000000000278A000-memory.dmp

Filesize
40KB

Download
memory/3912-26-0x00000000083D0000-0x00000000089E8000-memory.dmp

Filesize
6.1MB

Download
memory/3912-28-0x0000000007570000-0x0000000007582000-memory.dmp

Filesize
72KB

Download
memory/3912-29-0x00000000075D0000-0x000000000760C000-memory.dmp

Filesize
240KB

Download
memory/3912-30-0x0000000007760000-0x00000000077AC000-memory.dmp

Filesize
304KB

Download
memory/4080-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4080-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download