mystic | 9b80269950e0f1b633a8f97657fa8c4843d63cc1062890797edcbbcf58625520

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe
Size

559KB
MD5

19acbb53fb57ee0970d5ad438b17e6c0
SHA1

8b604ca7a275ac23dfa9d8533d335bf0f35a8b4c
SHA256

44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2
SHA512

7a765b8aa6043938099ed5b1f36858f2dd53dd85f6e1c577e136327a7218cd13e732c3e740827510bb4c1eaa11767f1f82106bab6adf068ad6bc00c1d34df208
SSDEEP

12288:cMr4y90LLrvKoJZVVY+s/Pyf2Sh5mERfbj7WFMFj+TP8fZCOu:8yw/JtNgxizj7W0jkCZk

Score

10^/10

mystic redline kinder infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinder

109.107.182.133:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral7/memory/1976-7-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral7/memory/1976-8-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral7/memory/1976-11-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral7/memory/1976-9-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/files/0x00070000000234a8-13.dat	family_redline
behavioral7/memory/1056-16-0x0000000000220000-0x000000000025E000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
2868	1zO01kh4.exe
1056	2MK654Ee.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 1976	2868	1zO01kh4.exe	92

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1664	1976	WerFault.exe	92

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2868	4680	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe	82
PID 4680 wrote to memory of 2868	4680	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe	82
PID 4680 wrote to memory of 2868	4680	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe	82
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 2868 wrote to memory of 1976	2868	1zO01kh4.exe	92
PID 4680 wrote to memory of 1056	4680	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe	93
PID 4680 wrote to memory of 1056	4680	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe	93
PID 4680 wrote to memory of 1056	4680	44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe	93

C:\Users\Admin\AppData\Local\Temp\44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe
"C:\Users\Admin\AppData\Local\Temp\44ba27c950b0c14f429cb6252215fa6bdf9cb6c714a1890cbaae75274f91f4f2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1zO01kh4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1zO01kh4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1976
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 540
      4⤵
      Program crash
      PID:1664
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2MK654Ee.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2MK654Ee.exe
  2⤵
  - Executes dropped EXE
  PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1976 -ip 1976
1⤵
PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1zO01kh4.exe

Filesize
1.1MB

MD5
7d1ba2f3278f1182c3a6d09ccb9df3d4

SHA1
87589e8214d43c9d89da777f17ea0d0df3e5369d

SHA256
6afbab356c4ae285cc355d7ff62173f8f809f2fa7a442bb832301da537c72ce8

SHA512
ebf7c9b462507a8f6931c4258a7233ac4423dbd4b713ada9def28c9dd9c92247828ea1fd546d9865ac7f55915310694053a609489679958530d7226beac38f9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2MK654Ee.exe

Filesize
222KB

MD5
9d35c1f6a74051864ecddef73b350a64

SHA1
15f18992b041ae3568a9a7ea9a0015b9fef37be1

SHA256
5146ce69fb90080fca072c54b146690633e73d842a95f6e5f567bdd3eaa48e41

SHA512
541f437cb4d1a89b6693a45559bfbbc2a3bf04c551a57c377a71635ebb1b25e7a1142b1b48615ff26de3ff0843880988ae91def91c2ea0192615cdb2a5a5797c

Download Submit
memory/1056-21-0x0000000008090000-0x00000000086A8000-memory.dmp

Filesize
6.1MB

Download
memory/1056-20-0x00000000045E0000-0x00000000045EA000-memory.dmp

Filesize
40KB

Download
memory/1056-27-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/1056-26-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/1056-15-0x000000007491E000-0x000000007491F000-memory.dmp

Filesize
4KB

Download
memory/1056-16-0x0000000000220000-0x000000000025E000-memory.dmp

Filesize
248KB

Download
memory/1056-17-0x00000000074C0000-0x0000000007A64000-memory.dmp

Filesize
5.6MB

Download
memory/1056-18-0x0000000006FF0000-0x0000000007082000-memory.dmp

Filesize
584KB

Download
memory/1056-19-0x0000000074910000-0x00000000750C0000-memory.dmp

Filesize
7.7MB

Download
memory/1056-25-0x00000000072C0000-0x000000000730C000-memory.dmp

Filesize
304KB

Download
memory/1056-24-0x0000000007280000-0x00000000072BC000-memory.dmp

Filesize
240KB

Download
memory/1056-22-0x0000000007390000-0x000000000749A000-memory.dmp

Filesize
1.0MB

Download
memory/1056-23-0x00000000070D0000-0x00000000070E2000-memory.dmp

Filesize
72KB

Download
memory/1976-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1976-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1976-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1976-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads