mystic | b0707ded6960936877cf4a2a4a5a7191894ea5c19ee70296e7004b5431f5044e

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe
Size 1.5MB
Sample240523-l22pdscf42
SHA256 2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f
MD5 b61170f2b227f99ed0257b938906f686
SHA1 f6a839a52f0af527b1ae2a4b37946941b18da532
SHA512 97ba944bc336d05f72362828c87f6101ffd639d8edf47d52e94648396a5075b771dfd46bdfc5347a911460647d4d10eb91032d848374e21b53341a1f1ad86c94
SSDEEP 24576:Ey0Xn/cq0cXV5RSiGOQqZFoZiQVrRmG47oeQBVx6WolM2y32bRu9MzkWfB0yxNlV:T0UwXVuHOvmRr48eQV6Woy52bR0ikgXN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral2/memory/2352-35-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral2/memory/2352-40-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral2/memory/2352-38-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023442-41.dat	family_redline
behavioral2/memory/4792-42-0x00000000001F0000-0x000000000022E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
884	rb1iO5dt.exe
1972	az8gH1bQ.exe
2300	hv1Zo4YT.exe
3712	DB4Dh1xd.exe
4992	1Ql97iH7.exe
4792	2WD944JN.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	az8gH1bQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hv1Zo4YT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	DB4Dh1xd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	rb1iO5dt.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4992 set thread context of 2352	4992	1Ql97iH7.exe	93

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 884	4580	2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe	83
PID 4580 wrote to memory of 884	4580	2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe	83
PID 4580 wrote to memory of 884	4580	2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe	83
PID 884 wrote to memory of 1972	884	rb1iO5dt.exe	84
PID 884 wrote to memory of 1972	884	rb1iO5dt.exe	84
PID 884 wrote to memory of 1972	884	rb1iO5dt.exe	84
PID 1972 wrote to memory of 2300	1972	az8gH1bQ.exe	86
PID 1972 wrote to memory of 2300	1972	az8gH1bQ.exe	86
PID 1972 wrote to memory of 2300	1972	az8gH1bQ.exe	86
PID 2300 wrote to memory of 3712	2300	hv1Zo4YT.exe	87
PID 2300 wrote to memory of 3712	2300	hv1Zo4YT.exe	87
PID 2300 wrote to memory of 3712	2300	hv1Zo4YT.exe	87
PID 3712 wrote to memory of 4992	3712	DB4Dh1xd.exe	89
PID 3712 wrote to memory of 4992	3712	DB4Dh1xd.exe	89
PID 3712 wrote to memory of 4992	3712	DB4Dh1xd.exe	89
PID 4992 wrote to memory of 3480	4992	1Ql97iH7.exe	92
PID 4992 wrote to memory of 3480	4992	1Ql97iH7.exe	92
PID 4992 wrote to memory of 3480	4992	1Ql97iH7.exe	92
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 4992 wrote to memory of 2352	4992	1Ql97iH7.exe	93
PID 3712 wrote to memory of 4792	3712	DB4Dh1xd.exe	94
PID 3712 wrote to memory of 4792	3712	DB4Dh1xd.exe	94
PID 3712 wrote to memory of 4792	3712	DB4Dh1xd.exe	94

C:\Users\Admin\AppData\Local\Temp\2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe
"C:\Users\Admin\AppData\Local\Temp\2c5911fd0a616aa00118b87a5216b4c3312dd590b4988b62bf0651b91fc5b29f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb1iO5dt.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb1iO5dt.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\az8gH1bQ.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\az8gH1bQ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hv1Zo4YT.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hv1Zo4YT.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\DB4Dh1xd.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\DB4Dh1xd.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ql97iH7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ql97iH7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3480
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2WD944JN.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2WD944JN.exe
        6⤵
        Executes dropped EXE
        
        PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

rb1iO5dt.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb1iO5dt.exe
Size 1.3MB
SHA256 6a3545cda45590fc91fec8603a3aac56b54d479cac9a6e087c42f91c570281c8
MD5 3f4ca944008c4dcff46b5b997bb8a800
SHA1 9006ff43730ce592201644b01c511dab93c61e15
SHA512 e182896ae69ededa51f8d648e382fe6d1d760df0409c7d25704628f2789b93204a4c92e803403b8c0c5acf3f85ac6cae39714b320c8e325676a1193d4c28191c
SSDEEP 24576:0yXwZAs6tV591PGiQ0Za1/iatrZ6jlWWNQUV66eGSJL2aRh9tz5Qbl0dTa3x8wB:DPlV9Oi5KVOlnNQ16eGU2aR395IsTa3l
MD5 SHA1 SHA512 SSDEEP

Submit Download

az8gH1bQ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\az8gH1bQ.exe
Size 1.2MB
SHA256 48e846285e801d49dd5d05f47221081d435a06c56c6589fe17eeac5717d719b2
MD5 f92e5e996f83e79374e278abadaa2c1a
SHA1 f3aaed4da0cd83acd9f9e886bd31752bab556455
SHA512 928c80c6f4c13dda769e1bc3ad9907f9aec00680982c10797c46a6d4430350c8e1b88ed50b5bda149196c18bfffa542039c14e6fc4673cda63aaa02b6342cead
SSDEEP 24576:fyfV5Y2wW0Zaq5i2rrJ6Jo+rDJUVy6HeSAm2/RfBJz5KT4Qvg:qfV9wX7byouDJP6HeU2/RJJ5W
MD5 SHA1 SHA512 SSDEEP

Submit Download

hv1Zo4YT.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hv1Zo4YT.exe
Size 762KB
SHA256 150afc37eb14278d713b519bde711660f055deddf2d15da2426809b93afa6911
MD5 f88e3b791b17673243e1facd2c102508
SHA1 73e10c001843daf0871db5aba867d82b11d659c5
SHA512 d2817b3c1418088636b282b50989cc8f969e48d900fea9e4eb939b78648e02be22783b4d04ac479447137a779f0ae84249c31887059bb1e40c8932ecda215269
SSDEEP 12288:HMrVy90vEi0DH9k40ZO8GL8+98GSRoLM621ppTfbnvvc4xBFKpKW6z6rlxE+P:iys0D+40ZOi+ibRoA6spHnftMVg6hmo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DB4Dh1xd.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\DB4Dh1xd.exe
Size 566KB
SHA256 b7cf97a41fc7ff3993a960bdb59bc68323c4991f67ec99fa6c26e527856df4e0
MD5 7fd6f9c72b2211a3179e68770a4364b8
SHA1 9f28f9f3009ca6d4882d6ea90a3f8412d7834aee
SHA512 b0e40ab2c016cb10618ed07588d0aadd57c29dcadcad4c6d323e6bc61c38a4596d78713ac64284f1aab301e38d1d022a64d1f7977e1ee5a54689bddf505c591d
SSDEEP 12288:OMrxy90SzQR8T98s0lBLN62XpD0lGnvHJjZAE:vyxTiblBJ6eDBnxZt
MD5 SHA1 SHA512 SSDEEP

Submit Download

1Ql97iH7.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ql97iH7.exe
Size 1.1MB
SHA256 1bf5cec3c254448c4c70558dc424e41f1c52255d582ac0aabb0a64c028cddf9a
MD5 a118fd63dea8b22dd475f652caf621c5
SHA1 5b52fd31b5ba0dfb104f8dd63c94f94a8b41b61c
SHA512 4661862d7b6d82fc53fd1016b384a402d49eed6e72e200a10346d63cf34c979c5a2da303f2befba7cf31ebbaea08c693a9d30af27dd3d6b1bd2a04e4a7a1f156
SSDEEP 12288:TwYCmwW9gl9QsxQ2rLuiCessdWlco2tyya+3YrufCZb/tQQUPmbJm:TvWW9gl9QsxQCLX3dhbpjHPmb
MD5 SHA1 SHA512 SSDEEP

Submit Download

2WD944JN.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2WD944JN.exe
Size 221KB
SHA256 8ed359cdd6330f9b84400f9ca839b074ac2a4af2d6839a942cbaf295f24076d8
MD5 f5549b39fbbdb4b0f3f642ef38983ee5
SHA1 259544067b74db1f8cb08a3c8b3413b3c3861f36
SHA512 eb10566a644ea029fa51f72f528475847c72b9e564857e98c065c792fa6f6d31c21ada77e0f360117e78d23198093824119f984f99c072f77debda2f04edeb95
SSDEEP 6144:EmSQQNgcPf2iHv0+9JR/xadbzBNFygk5:DHQNgcPf1JROBNFygk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2352-38-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2352-40-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2352-35-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/4792-42-0x00000000001F0000-0x000000000022E000-memory.dmp

Download

memory/4792-43-0x0000000007520000-0x0000000007AC4000-memory.dmp

Download

memory/4792-44-0x0000000007010000-0x00000000070A2000-memory.dmp

Download

memory/4792-45-0x0000000004590000-0x000000000459A000-memory.dmp

Download

memory/4792-46-0x00000000080F0000-0x0000000008708000-memory.dmp

Download

memory/4792-47-0x00000000073C0000-0x00000000074CA000-memory.dmp

Download

memory/4792-48-0x00000000071C0000-0x00000000071D2000-memory.dmp

Download

memory/4792-49-0x0000000007220000-0x000000000725C000-memory.dmp

Download

memory/4792-50-0x00000000072B0000-0x00000000072FC000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads