mystic | 9f4cee8892544b3b9090f5a7288e0a353e34bada2f75253f19bfebaefa1f0f53

Analysis

max time kernel
134s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe
Size

562KB
MD5

d251764d069bab0638824c87cb165aeb
SHA1

0d494f305b99a1dc6eb0a5975c9a14752a41a166
SHA256

2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19
SHA512

6b53824cf7ab1cd26f8052544a446471f1719bc8dd75ee5bdd7bd0db9044c16b756fd975c29549e8f1549027674c0b9073749cd5365dd77570e0d2fcb4f81b8d
SSDEEP

12288:1Mrky903T8TiTWrrVK31Ht/q7CErraIitJ00Q9ZQkoCiznSVk:tyHJCH/ErraIKu0uQkbCSm

Score

10^/10

mystic redline gadki infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gadki

77.91.124.82:19071

Attributes

auth_value
2efd98e4d8880b45676de60a0faf778f

Signatures

Detect Mystic stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral6/memory/3084-14-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral6/memory/3084-16-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral6/memory/3084-18-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral6/memory/3084-15-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8771580.exe	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0591710.exe	family_redline
behavioral6/memory/1028-22-0x00000000001E0000-0x0000000000210000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

x9235905.exeg1258529.exeh0591710.exei8771580.exe

pid process

1044 x9235905.exe
1236 g1258529.exe
1028 h0591710.exe
872 i8771580.exe

pid	process
1044	x9235905.exe
1236	g1258529.exe
1028	h0591710.exe
872	i8771580.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exex9235905.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x9235905.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

g1258529.exe

description pid process target process

PID 1236 set thread context of 3084 1236 g1258529.exe AppLaunch.exe
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

2828 1236 WerFault.exe g1258529.exe
4628 3084 WerFault.exe AppLaunch.exe
2424 1028 WerFault.exe h0591710.exe

description	pid	process	target process
PID 1236 set thread context of 3084	1236	g1258529.exe	AppLaunch.exe

pid	pid_target	process	target process
2828	1236	WerFault.exe	g1258529.exe
4628	3084	WerFault.exe	AppLaunch.exe
2424	1028	WerFault.exe	h0591710.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exex9235905.exeg1258529.exe

description	pid	process	target process
PID 2524 wrote to memory of 1044	2524	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe	x9235905.exe
PID 2524 wrote to memory of 1044	2524	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe	x9235905.exe
PID 2524 wrote to memory of 1044	2524	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe	x9235905.exe
PID 1044 wrote to memory of 1236	1044	x9235905.exe	g1258529.exe
PID 1044 wrote to memory of 1236	1044	x9235905.exe	g1258529.exe
PID 1044 wrote to memory of 1236	1044	x9235905.exe	g1258529.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1236 wrote to memory of 3084	1236	g1258529.exe	AppLaunch.exe
PID 1044 wrote to memory of 1028	1044	x9235905.exe	h0591710.exe
PID 1044 wrote to memory of 1028	1044	x9235905.exe	h0591710.exe
PID 1044 wrote to memory of 1028	1044	x9235905.exe	h0591710.exe
PID 2524 wrote to memory of 872	2524	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe	i8771580.exe
PID 2524 wrote to memory of 872	2524	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe	i8771580.exe
PID 2524 wrote to memory of 872	2524	2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe	i8771580.exe

C:\Users\Admin\AppData\Local\Temp\2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe
"C:\Users\Admin\AppData\Local\Temp\2ae8e0e7200682b017c2fa4be81c84b2547e0238ade702b5112641b6b336bc19.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9235905.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9235905.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1258529.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1258529.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3084
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 560
        5⤵
        Program crash
        
        PID:4628
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 564
      4⤵
      Program crash
      PID:2828
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0591710.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0591710.exe
    3⤵
    - Executes dropped EXE
    PID:1028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1028 -s 928
      4⤵
      Program crash
      PID:2424
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8771580.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8771580.exe
  2⤵
  - Executes dropped EXE
  PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3084 -ip 3084
1⤵
PID:3932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1236 -ip 1236
1⤵
PID:3820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1028 -ip 1028
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\i8771580.exe

Filesize
140KB

MD5
03f1f8704f8431e86ad34599160b5f72

SHA1
e5794faa16938d4ab3b04a3243c34faf2d5acfa9

SHA256
b713fb351f89eb437fbd77566e3241b747405d3d85d98ff03f1317692667eb01

SHA512
78e2bc19192b70535b46de672b348faa27e6a7081c53d398ca426f906add08070cb5ed57bb07741f497f9109666dad1029e6f5f5dac9492d56ee1337842e2c75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x9235905.exe

Filesize
397KB

MD5
7d3d599a978cdb7a9ad1ac3f4e0a4a7c

SHA1
2f9383d00016041334b2e951b276505a83e16ef1

SHA256
5f582f2e92bbfbb81c7df8218c3bc4b117bf9ec238b6c946e94129b98f780fa2

SHA512
2e02683f8016e6b0177bec6436d359c23d28ecb76da40f5fb5249da500fa5469c088c3c9b1e73642f3091e5d14e2537affab4d4fba55d2ebfeffd1e11b9d03eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g1258529.exe

Filesize
379KB

MD5
55dfba89fa4ed4918c600a908a53c0d0

SHA1
b1cc334314d0b29b7e6a792f5b0e75e536830fc9

SHA256
2021f0bd15ad360b7d84ba0b921e540636e8a205225f4e780086e4a9bf6eda14

SHA512
ba650a0ed21da04dd8baa6b6747c0cd0ab78e54e8435a93786b286585126cbbcdaea0208e49bc08941c5576f89219363541a6f8aa1def697e8f371b1354b6785

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h0591710.exe

Filesize
174KB

MD5
b7f3ca30d5c6ea94d5a2a1c9d5c41ef0

SHA1
4c238a4542a441bd69df4a2cbe582f9fd5f3f38b

SHA256
45196ef8cc6f6246c196c09190a57735b05d61f5b1ae39ed0339650e7365b684

SHA512
9db4267b64c288688f6762996dc5d52e1945209237e88a297239905358fcdef244e5fbc6346884b5b263a1c414c05851003eb2705fc0adcc7a948d2a25740847

Download Submit
memory/1028-22-0x00000000001E0000-0x0000000000210000-memory.dmp

Filesize
192KB

Download
memory/3084-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3084-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3084-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3084-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download