mystic | 92023f346ccc819d9c52da2af751cda1bc5396b5d745c68d99d1d2ff99db093a

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe
Size

942KB
MD5

a4749171d8ad764d03818f126f217d5d
SHA1

6a79bb5f782bdd877dbb1bb4b48d62fd3f785cf0
SHA256

d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51
SHA512

76848343db7274895acb25a3de56f99434944a8a9bff24de242baeacbb29ee449a92a54b655071aa4033201bd435907ad241b4f903a7fd61b5557eaf74701fc5
SSDEEP

24576:4yhABagNJNsKqbH6md/zL/kPG2LZe4cV4nvsKwvq:/hAvN/iH62HkeCcavFw

Score

10^/10

mystic redline kendo infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kendo

77.91.124.82:19071

Attributes

auth_value
5a22a881561d49941415902859b51f14

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral17/memory/1812-28-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral17/memory/1812-31-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral17/memory/1812-29-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral17/files/0x000700000002342f-33.dat	family_redline
behavioral17/memory/2220-35-0x0000000000DF0000-0x0000000000E20000-memory.dmp	family_redline

Executes dropped EXE 5 IoCs

pid	Process
1144	x2090614.exe
896	x3708693.exe
4500	x5046877.exe
4904	g0954082.exe
2220	h2669087.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x2090614.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x3708693.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	x5046877.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4904 set thread context of 1812	4904	g0954082.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3088	4904	WerFault.exe	86

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1144	4508	d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe	83
PID 4508 wrote to memory of 1144	4508	d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe	83
PID 4508 wrote to memory of 1144	4508	d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe	83
PID 1144 wrote to memory of 896	1144	x2090614.exe	84
PID 1144 wrote to memory of 896	1144	x2090614.exe	84
PID 1144 wrote to memory of 896	1144	x2090614.exe	84
PID 896 wrote to memory of 4500	896	x3708693.exe	85
PID 896 wrote to memory of 4500	896	x3708693.exe	85
PID 896 wrote to memory of 4500	896	x3708693.exe	85
PID 4500 wrote to memory of 4904	4500	x5046877.exe	86
PID 4500 wrote to memory of 4904	4500	x5046877.exe	86
PID 4500 wrote to memory of 4904	4500	x5046877.exe	86
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4904 wrote to memory of 1812	4904	g0954082.exe	88
PID 4500 wrote to memory of 2220	4500	x5046877.exe	94
PID 4500 wrote to memory of 2220	4500	x5046877.exe	94
PID 4500 wrote to memory of 2220	4500	x5046877.exe	94

C:\Users\Admin\AppData\Local\Temp\d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe
"C:\Users\Admin\AppData\Local\Temp\d2d831c046edce3072fd8f388c2954aefb3a8b6e2b64384d613bdd5478a9ea51.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2090614.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2090614.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3708693.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3708693.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5046877.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5046877.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0954082.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0954082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4904
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1812
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 564
        6⤵
        Program crash
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2669087.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2669087.exe
        5⤵
        Executes dropped EXE
        
        PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4904 -ip 4904
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x2090614.exe

Filesize
840KB

MD5
0686c7f4077c8e576c9cf3840c66dd51

SHA1
a97cecfcc0cc2ae011e52acc33bafc1c78a7cf75

SHA256
57b89b6424836a3629a678745f33f609a8bb9a248b55a615e84959120127b9f4

SHA512
bc0eaef74fb04a4f938928b356ef19ac9b3bac143b7b4b14bf09466d61bec6065868699409471fb8a10c2ab773eddd0e68fcae0dbadcb1aa96d0f27e1927827b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x3708693.exe

Filesize
563KB

MD5
af620fd59a4bafd102665e997c30da2c

SHA1
10b5c6811d9a94e705455b752ce192cb7df63cdb

SHA256
5b8f4b5462960bcd45c1650886ac078abce8c6cc60f0bcede86de66d57dd3db9

SHA512
c8c30f019a6eae7409566d5dd16af99fd68f832a36ecdb1b7fc9ca73c3e56aff72418305e8914827d93928980e4cba18b8f23bc36938cd593063239a072a923f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x5046877.exe

Filesize
397KB

MD5
59bba4ea5c03d2943e288604cb497284

SHA1
85e534e77c19ec6f91dcc1c0d51e50a08bdfad12

SHA256
777643de788596c0a8de1e66a747491454e52f0e918a9ff5900c21fcc8483b38

SHA512
83800cfc8db1a98bcec7b3036ff70ab2fb5a576bf2cf82aee2cf69ec8f4a4ba30aea176c847280f32673b5067fa2f02c380ba79a628a2c0c06eebaebe94e1d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g0954082.exe

Filesize
379KB

MD5
7ed6fb8894c6c0dca30833a4b030b9ea

SHA1
04e5792c834a6468c7aaa061dc5a14e554d485d8

SHA256
0460eda2a91b400167c75bed00aeec3faf953909fbf95ff0653d0cbbbe73c181

SHA512
102ee7b44e79e9f969d0980ba49831c8db1339637e7a4d800217c27464a93d0b79e545b254702fc17951c6aecb6025fee6f195e268160db1fa474dd714dc3c37

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\h2669087.exe

Filesize
174KB

MD5
518481e7a19cde26a57c0473abbdd7f3

SHA1
e89b4612e30136f82626bb155923fbb94a180e07

SHA256
f0e69748b55e52ee96dd0319e02f2ff10500b37b8adb7f370b521661cbdc39ac

SHA512
4d271c15eabfcf69f5f9ce7205151ed8451208f942374a186f35325a74625d0aafbd91426e110e9364bab1d5003086b3639d4b16858b1abd70680399eb1d88ce

Download Submit
memory/1812-29-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1812-31-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1812-28-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-35-0x0000000000DF0000-0x0000000000E20000-memory.dmp

Filesize
192KB

Download
memory/2220-36-0x00000000031C0000-0x00000000031C6000-memory.dmp

Filesize
24KB

Download
memory/2220-37-0x0000000005E90000-0x00000000064A8000-memory.dmp

Filesize
6.1MB

Download
memory/2220-38-0x0000000005980000-0x0000000005A8A000-memory.dmp

Filesize
1.0MB

Download
memory/2220-39-0x0000000003220000-0x0000000003232000-memory.dmp

Filesize
72KB

Download
memory/2220-40-0x00000000057F0000-0x000000000582C000-memory.dmp

Filesize
240KB

Download
memory/2220-41-0x0000000005870000-0x00000000058BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads