mystic | d66c5907218da0e1082f3a1318226d1c5bab6bd1ebb57b034a817b4c35495ac8

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe
Size

396KB
MD5

dc84eacc27933a0db96d90c12de60717
SHA1

3a646269f3e30b522598ccb2aa18bf4c115cf89b
SHA256

e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05
SHA512

2b51577ffc104848fdcfce1c3ee63c4c708d3d79f9e21f2696e7360ded105c0be9d3ccff515f6944c6df17bdaef6ebeac2847e70eb451efc784060ccf9643f6c
SSDEEP

12288:oMrly90p3B0Wf5Gr0azGyQIh8Ak/61zcOjV/5oBN:dyI0WS0Fycuae15oBN

Score

10^/10

mystic redline luate infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

luate

77.91.124.55:19071

Attributes

auth_value
e45cd419aba6c9d372088ffe5629308b

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral18/memory/4176-7-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral18/memory/4176-9-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral18/memory/4176-8-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral18/memory/4176-11-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h0365446.exe	family_redline
behavioral18/memory/3132-16-0x0000000000360000-0x0000000000390000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

g5431670.exeh0365446.exe

pid process

3124 g5431670.exe
3132 h0365446.exe

pid	process
3124	g5431670.exe
3132	h0365446.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

g5431670.exe

description pid process target process

PID 3124 set thread context of 4176 3124 g5431670.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

3148 4176 WerFault.exe AppLaunch.exe
1036 3124 WerFault.exe g5431670.exe

description	pid	process	target process
PID 3124 set thread context of 4176	3124	g5431670.exe	AppLaunch.exe

pid	pid_target	process	target process
3148	4176	WerFault.exe	AppLaunch.exe
1036	3124	WerFault.exe	g5431670.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exeg5431670.exe

description	pid	process	target process
PID 1844 wrote to memory of 3124	1844	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe	g5431670.exe
PID 1844 wrote to memory of 3124	1844	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe	g5431670.exe
PID 1844 wrote to memory of 3124	1844	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe	g5431670.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 3124 wrote to memory of 4176	3124	g5431670.exe	AppLaunch.exe
PID 1844 wrote to memory of 3132	1844	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe	h0365446.exe
PID 1844 wrote to memory of 3132	1844	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe	h0365446.exe
PID 1844 wrote to memory of 3132	1844	e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe	h0365446.exe

C:\Users\Admin\AppData\Local\Temp\e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe
"C:\Users\Admin\AppData\Local\Temp\e7bd826b7a1c65ad222cefa93d7967f2a11f90fd400aa046a5a96ec60cff1a05.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5431670.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5431670.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4176 -s 540
      4⤵
      Program crash
      PID:3148
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3124 -s 584
    3⤵
    - Program crash
    PID:1036
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h0365446.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h0365446.exe
  2⤵
  - Executes dropped EXE
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4176 -ip 4176
1⤵
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3124 -ip 3124
1⤵
PID:1468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g5431670.exe

Filesize
379KB

MD5
00d0cb71980274e40584bf35f73b70ca

SHA1
fa3b8358a851dc1c0119ad9f03cc3d23f5b1a79f

SHA256
5b4f4d6081f3738f7e91d856d861a211d9eb8aa755b450b9a1cde919cda00491

SHA512
d72b42909a8c892a07338c78c93064466bd2bd9647e4052a07d200e7e374cd634c369acec759259c65aa9648d396f6b55c9dc2b0eef7c1d349926b55a5130917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h0365446.exe

Filesize
174KB

MD5
7f20e3ff05141ef971fc09881c0226da

SHA1
dd9db25758dc09a710ff403506df872f3616a1c1

SHA256
3e0240835279141c4cbee9935ce444cc3eefb59decf2ac1e29c847fadc81e10b

SHA512
31a81c810c3177fb6b267f88401380fcc20d386ac669ab9a1a6b58db525a3a79e9dd1712796106b8378c094e16931fc664c71aa712e2647f75a9cdb930991915

Download Submit
memory/3132-21-0x0000000004D60000-0x0000000004D9C000-memory.dmp

Filesize
240KB

Download
memory/3132-18-0x0000000005380000-0x0000000005998000-memory.dmp

Filesize
6.1MB

Download
memory/3132-25-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/3132-24-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/3132-15-0x000000007472E000-0x000000007472F000-memory.dmp

Filesize
4KB

Download
memory/3132-16-0x0000000000360000-0x0000000000390000-memory.dmp

Filesize
192KB

Download
memory/3132-17-0x0000000002720000-0x0000000002726000-memory.dmp

Filesize
24KB

Download
memory/3132-23-0x0000000004DA0000-0x0000000004DEC000-memory.dmp

Filesize
304KB

Download
memory/3132-19-0x0000000004E70000-0x0000000004F7A000-memory.dmp

Filesize
1.0MB

Download
memory/3132-20-0x0000000002890000-0x00000000028A2000-memory.dmp

Filesize
72KB

Download
memory/3132-22-0x0000000074720000-0x0000000074ED0000-memory.dmp

Filesize
7.7MB

Download
memory/4176-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4176-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4176-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4176-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download