mystic | b0707ded6960936877cf4a2a4a5a7191894ea5c19ee70296e7004b5431f5044e

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Size

759KB
MD5

b69c615e91840a82076fe1dc0175cd5c
SHA1

bb23d10b27c9fb45af61d9414f31944bbfd6d62b
SHA256

6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6
SHA512

5a4aa247c3bb6167c03c050c2899f8a669c3835a93ee16509dfbeb2f06eae38b4cec1e3c8a5efc65e8df2eba665c1f42b85b192edd3fb2f7d1ce43761d134c90
SSDEEP

12288:4MrMy90OPICz9hQnKZKC5Z7O9mpz53ClrunebLXR0prExFgUI24a211bt:kyrPJQKZKC5ZCkz5SRunebLB0p3UH4ao

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral8/memory/1860-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/1860-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/1860-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/1860-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe	family_redline
behavioral8/memory/5080-22-0x00000000005E0000-0x000000000061E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

En4Gf9Pe.exe1uj82fO7.exe2GV644kk.exe

pid process

3228 En4Gf9Pe.exe
2328 1uj82fO7.exe
5080 2GV644kk.exe

pid	process
3228	En4Gf9Pe.exe
2328	1uj82fO7.exe
5080	2GV644kk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exeEn4Gf9Pe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	En4Gf9Pe.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1uj82fO7.exe

description pid process target process

PID 2328 set thread context of 1860 2328 1uj82fO7.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1792 1860 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2328 set thread context of 1860	2328	1uj82fO7.exe	AppLaunch.exe

pid	pid_target	process	target process
1792	1860	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exeEn4Gf9Pe.exe1uj82fO7.exe

description	pid	process	target process
PID 5052 wrote to memory of 3228	5052	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	En4Gf9Pe.exe
PID 5052 wrote to memory of 3228	5052	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	En4Gf9Pe.exe
PID 5052 wrote to memory of 3228	5052	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	En4Gf9Pe.exe
PID 3228 wrote to memory of 2328	3228	En4Gf9Pe.exe	1uj82fO7.exe
PID 3228 wrote to memory of 2328	3228	En4Gf9Pe.exe	1uj82fO7.exe
PID 3228 wrote to memory of 2328	3228	En4Gf9Pe.exe	1uj82fO7.exe
PID 2328 wrote to memory of 2064	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 2064	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 2064	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 2328 wrote to memory of 1860	2328	1uj82fO7.exe	AppLaunch.exe
PID 3228 wrote to memory of 5080	3228	En4Gf9Pe.exe	2GV644kk.exe
PID 3228 wrote to memory of 5080	3228	En4Gf9Pe.exe	2GV644kk.exe
PID 3228 wrote to memory of 5080	3228	En4Gf9Pe.exe	2GV644kk.exe

C:\Users\Admin\AppData\Local\Temp\6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
"C:\Users\Admin\AppData\Local\Temp\6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2064
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1860
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 540
        5⤵
        Program crash
        
        PID:1792
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
    3⤵
    - Executes dropped EXE
    PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1860 -ip 1860
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe

Filesize
562KB

MD5
b062259b5db02d3f43088b71fc2efeb5

SHA1
83d8cf252d4bda4af35074676577df6dcb89355b

SHA256
2dc87d1a3ce91494e1e59b6b06c1e26d6d3149e46465bae9d5cf72d4d9316567

SHA512
fc3f13a6265fb9fda48f574853f8581ba0a08e48746c0729ec1b2d10202cb37780c9dfcb21f774f598b2921e59fdcae1d71534378ef34c5a2831d3426af27d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe

Filesize
1.1MB

MD5
cf8a8afe6b52833ef82cbe9d5742082d

SHA1
ac2de55f6d4f189ce18ecd2adc792fea4f14c624

SHA256
c83b3837583a5fe78c1ba95e3b5785023550c02c2940664725c2b8e2a5eabf34

SHA512
e273917afb1cc984cea1d1573938aae1fcf7ccfa2edecaa3643e5b288e517c66228624359f93a6e38cd3ce284d20c217b802ac532a1253532b5ad21fbf2400d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe

Filesize
222KB

MD5
80b7f3f936cef5ca29f7b5db2e093cec

SHA1
47706281df477fbc57e9cdbb5f43c0b868950950

SHA256
80bd0280b2703d0f67159a20f3eda6f06e69f1d7da5023d8a9670325e10e8c23

SHA512
b048e15acc0d34b464f660c09979c25c09dc646d6ecfccb1835e451e574bca155495859a31ef1785ed7c178fcf4e04b015c774200887440e2e00cea457b34854

Download Submit
memory/1860-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1860-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1860-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1860-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5080-23-0x00000000079A0000-0x0000000007F44000-memory.dmp

Filesize
5.6MB

Download
memory/5080-22-0x00000000005E0000-0x000000000061E000-memory.dmp

Filesize
248KB

Download
memory/5080-24-0x00000000074E0000-0x0000000007572000-memory.dmp

Filesize
584KB

Download
memory/5080-25-0x0000000002960000-0x000000000296A000-memory.dmp

Filesize
40KB

Download
memory/5080-26-0x0000000008570000-0x0000000008B88000-memory.dmp

Filesize
6.1MB

Download
memory/5080-27-0x0000000007880000-0x000000000798A000-memory.dmp

Filesize
1.0MB

Download
memory/5080-28-0x00000000076C0000-0x00000000076D2000-memory.dmp

Filesize
72KB

Download
memory/5080-29-0x0000000007770000-0x00000000077AC000-memory.dmp

Filesize
240KB

Download
memory/5080-30-0x00000000077B0000-0x00000000077FC000-memory.dmp

Filesize
304KB

Download