mystic | 9f4cee8892544b3b9090f5a7288e0a353e34bada2f75253f19bfebaefa1f0f53

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe
Size

912KB
MD5

e9b14be79a6909ca38f58170004f3cdd
SHA1

b00c579790015e8312c932100446631bac44ae79
SHA256

f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871
SHA512

f40e080f0d45ea975a223a017af846ab7b28a50ef55a44cf3c25fe708008d5e89a21913192da271001c5589b339e8ee1e27aa3d8820ea93cb383680c4d3f1115
SSDEEP

24576:6yqPzRmBHa4Zyi7tOIfXl93jr+Du4dk1j:Bq8aFaNPzIu40

Score

10^/10

mystic redline luate infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

luate

77.91.124.55:19071

Attributes

auth_value
e45cd419aba6c9d372088ffe5629308b

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral19/memory/4300-31-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral19/memory/4300-30-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral19/memory/4300-28-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h0750968.exe	family_redline
behavioral19/memory/4776-35-0x0000000000150000-0x0000000000180000-memory.dmp	family_redline

Executes dropped EXE 5 IoCs

Processes:

x7266531.exex1568463.exex9099077.exeg4219675.exeh0750968.exe

pid process

1172 x7266531.exe
1772 x1568463.exe
1572 x9099077.exe
4772 g4219675.exe
4776 h0750968.exe

pid	process
1172	x7266531.exe
1772	x1568463.exe
1572	x9099077.exe
4772	g4219675.exe
4776	h0750968.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exex7266531.exex1568463.exex9099077.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x7266531.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x1568463.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x9099077.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

g4219675.exe

description pid process target process

PID 4772 set thread context of 4300 4772 g4219675.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1144 4772 WerFault.exe g4219675.exe

description	pid	process	target process
PID 4772 set thread context of 4300	4772	g4219675.exe	AppLaunch.exe

pid	pid_target	process	target process
1144	4772	WerFault.exe	g4219675.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exex7266531.exex1568463.exex9099077.exeg4219675.exe

description	pid	process	target process
PID 2772 wrote to memory of 1172	2772	f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe	x7266531.exe
PID 2772 wrote to memory of 1172	2772	f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe	x7266531.exe
PID 2772 wrote to memory of 1172	2772	f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe	x7266531.exe
PID 1172 wrote to memory of 1772	1172	x7266531.exe	x1568463.exe
PID 1172 wrote to memory of 1772	1172	x7266531.exe	x1568463.exe
PID 1172 wrote to memory of 1772	1172	x7266531.exe	x1568463.exe
PID 1772 wrote to memory of 1572	1772	x1568463.exe	x9099077.exe
PID 1772 wrote to memory of 1572	1772	x1568463.exe	x9099077.exe
PID 1772 wrote to memory of 1572	1772	x1568463.exe	x9099077.exe
PID 1572 wrote to memory of 4772	1572	x9099077.exe	g4219675.exe
PID 1572 wrote to memory of 4772	1572	x9099077.exe	g4219675.exe
PID 1572 wrote to memory of 4772	1572	x9099077.exe	g4219675.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 4772 wrote to memory of 4300	4772	g4219675.exe	AppLaunch.exe
PID 1572 wrote to memory of 4776	1572	x9099077.exe	h0750968.exe
PID 1572 wrote to memory of 4776	1572	x9099077.exe	h0750968.exe
PID 1572 wrote to memory of 4776	1572	x9099077.exe	h0750968.exe

C:\Users\Admin\AppData\Local\Temp\f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe
"C:\Users\Admin\AppData\Local\Temp\f02caa18679b8af0e356c5ecf5b840b3c4f001b4c623c0cf33686d9cf4111871.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7266531.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7266531.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1568463.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1568463.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9099077.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9099077.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4219675.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4219675.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4300
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4772 -s 592
        6⤵
        Program crash
        
        PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h0750968.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h0750968.exe
        5⤵
        Executes dropped EXE
        
        PID:4776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4772 -ip 4772
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x7266531.exe

Filesize
810KB

MD5
6171aa0144fda3e719c89aab628ec508

SHA1
e64177cc7bbeb1549281b4462c7850e5f01adf4e

SHA256
4aef90392bbd474e5bedb860c9d721d28c65cba2b23025678dfeb8309a769634

SHA512
f93db930f7c046ac841fe3c656c792a80a3abdc2d94d5f226e9d1175a27f6f15f93e77ed9b452f4f93045ccfd753b687e8c5c805e5c87dbb479cd84cddb65c8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x1568463.exe

Filesize
547KB

MD5
30f34f309e18ffb01d60d0e3039dbcaa

SHA1
f3d2d138a35679ab1fc75fdcff58e25710f5e44c

SHA256
405a2bfafda43aa18c79bd58d0c675dbbc0609921bb257c4bc86a8d5c8e38efe

SHA512
042c0b3326fde5813427da524b5b293413822a5828f72f9b17c785b3837ce5d8e15456f949ac6ba2115c31f49de6c3b281d8f0bc95aa7f6843f58717a9ada0f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x9099077.exe

Filesize
381KB

MD5
c719a50919a7715703f922fc70cc00d6

SHA1
d0989a6ee6dea2b65a70999fd9c6d78699d50470

SHA256
7729e0884205725cbe7c86dc566e363fcf29afbe5521681f7c2bfc1b22087ee1

SHA512
616feb50879917afd884f31c15992dff49692ed85462416f5991a3d19ae3fc0d9dd4a9ff2b5426938608a8e2b5eeff4d6d71cfc7600145e7bf2ee633e577cef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g4219675.exe

Filesize
346KB

MD5
fe1d5ad313e7f6621aa3c893e08cf494

SHA1
0b9878c06d1825e51d9b413ba96e6be58935fcd6

SHA256
9c716a6b50b1b967de579d688ef9c452ee22b746a5e7481f13fe2a1d763debd9

SHA512
46b5f302b6ab7e155beb76228b5aa33dfbf9b88a75d5cd5dcec79793da6cc5398c4283e23cddfe143ec641b1a91a4001de484011023140a74340e34781469ead

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h0750968.exe

Filesize
174KB

MD5
7921ed3b87eddc6b1977fdcee2877a09

SHA1
559dafdf2f846cb09851f5d707bdd1200ef85fdc

SHA256
4bf5bb9ad10950fc2396269bb4aaac2a5f4c76fa2901be4fa73a586cc72bd9b8

SHA512
8b297c32b9d3672c93c172de00a76b3ee2d68648d0021f7a52ad4cc7a6e38dd720ce50cdd06161988d2812cd1ceca2ea3d52efa764b3adf441896a3407b74143

Download Submit
memory/4300-28-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4300-30-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4300-31-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-35-0x0000000000150000-0x0000000000180000-memory.dmp

Filesize
192KB

Download
memory/4776-36-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4776-37-0x000000000A440000-0x000000000AA58000-memory.dmp

Filesize
6.1MB

Download
memory/4776-38-0x0000000009FC0000-0x000000000A0CA000-memory.dmp

Filesize
1.0MB

Download
memory/4776-39-0x0000000009F00000-0x0000000009F12000-memory.dmp

Filesize
72KB

Download
memory/4776-40-0x0000000009F60000-0x0000000009F9C000-memory.dmp

Filesize
240KB

Download
memory/4776-41-0x00000000044A0000-0x00000000044EC000-memory.dmp

Filesize
304KB

Download