mystic | b0707ded6960936877cf4a2a4a5a7191894ea5c19ee70296e7004b5431f5044e

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Size 759KB
Sample240523-lyrd9ace56
SHA256 6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6
MD5 b69c615e91840a82076fe1dc0175cd5c
SHA1 bb23d10b27c9fb45af61d9414f31944bbfd6d62b
SHA512 5a4aa247c3bb6167c03c050c2899f8a669c3835a93ee16509dfbeb2f06eae38b4cec1e3c8a5efc65e8df2eba665c1f42b85b192edd3fb2f7d1ce43761d134c90
SSDEEP 12288:4MrMy90OPICz9hQnKZKC5Z7O9mpz53ClrunebLXR0prExFgUI24a211bt:kyrPJQKZKC5ZCkz5SRunebLB0p3UH4ao
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral8/memory/544-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/544-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/544-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/544-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000700000002342c-20.dat	family_redline
behavioral8/memory/2944-22-0x00000000009C0000-0x00000000009FE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
516	En4Gf9Pe.exe
2492	1uj82fO7.exe
2944	2GV644kk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	En4Gf9Pe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 544	2492	1uj82fO7.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3888	544	WerFault.exe	88

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 516	4576	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	83
PID 4576 wrote to memory of 516	4576	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	83
PID 4576 wrote to memory of 516	4576	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	83
PID 516 wrote to memory of 2492	516	En4Gf9Pe.exe	84
PID 516 wrote to memory of 2492	516	En4Gf9Pe.exe	84
PID 516 wrote to memory of 2492	516	En4Gf9Pe.exe	84
PID 2492 wrote to memory of 2208	2492	1uj82fO7.exe	86
PID 2492 wrote to memory of 2208	2492	1uj82fO7.exe	86
PID 2492 wrote to memory of 2208	2492	1uj82fO7.exe	86
PID 2492 wrote to memory of 2624	2492	1uj82fO7.exe	87
PID 2492 wrote to memory of 2624	2492	1uj82fO7.exe	87
PID 2492 wrote to memory of 2624	2492	1uj82fO7.exe	87
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 516 wrote to memory of 2944	516	En4Gf9Pe.exe	90
PID 516 wrote to memory of 2944	516	En4Gf9Pe.exe	90
PID 516 wrote to memory of 2944	516	En4Gf9Pe.exe	90

C:\Users\Admin\AppData\Local\Temp\6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
"C:\Users\Admin\AppData\Local\Temp\6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2208
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2624
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 540
        5⤵
        Program crash
        
        PID:3888
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
    3⤵
    - Executes dropped EXE
    PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 544 -ip 544
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

En4Gf9Pe.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
Size 562KB
SHA256 2dc87d1a3ce91494e1e59b6b06c1e26d6d3149e46465bae9d5cf72d4d9316567
MD5 b062259b5db02d3f43088b71fc2efeb5
SHA1 83d8cf252d4bda4af35074676577df6dcb89355b
SHA512 fc3f13a6265fb9fda48f574853f8581ba0a08e48746c0729ec1b2d10202cb37780c9dfcb21f774f598b2921e59fdcae1d71534378ef34c5a2831d3426af27d4e
SSDEEP 12288:3Mryy90VXJL/HtpO9m4zT3C4runbRLmEpM:ZyUV/Ht0FzTSuunbRLZpM
MD5 SHA1 SHA512 SSDEEP

Submit Download

1uj82fO7.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
Size 1.1MB
SHA256 c83b3837583a5fe78c1ba95e3b5785023550c02c2940664725c2b8e2a5eabf34
MD5 cf8a8afe6b52833ef82cbe9d5742082d
SHA1 ac2de55f6d4f189ce18ecd2adc792fea4f14c624
SHA512 e273917afb1cc984cea1d1573938aae1fcf7ccfa2edecaa3643e5b288e517c66228624359f93a6e38cd3ce284d20c217b802ac532a1253532b5ad21fbf2400d4
SSDEEP 12288:UC9QBkraEA29ADR87kHCY7NNfRekbUji5kWuWSOJWm2c2F40RvH1SJeKK:UtirO29Ad87kHCADReQulbBlRvHEJe
MD5 SHA1 SHA512 SSDEEP

Submit Download

2GV644kk.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
Size 222KB
SHA256 80bd0280b2703d0f67159a20f3eda6f06e69f1d7da5023d8a9670325e10e8c23
MD5 80b7f3f936cef5ca29f7b5db2e093cec
SHA1 47706281df477fbc57e9cdbb5f43c0b868950950
SHA512 b048e15acc0d34b464f660c09979c25c09dc646d6ecfccb1835e451e574bca155495859a31ef1785ed7c178fcf4e04b015c774200887440e2e00cea457b34854
SSDEEP 6144:EmSQQNgcPf2iHv0+9JR/xadbzBNFygk5:DHQNgcPf1JROBNFygk5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-14-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/544-16-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/544-15-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/544-18-0x0000000000400000-0x0000000000434000-memory.dmp

Download

memory/2944-23-0x0000000007C30000-0x00000000081D4000-memory.dmp

Download

memory/2944-22-0x00000000009C0000-0x00000000009FE000-memory.dmp

Download

memory/2944-24-0x0000000007760000-0x00000000077F2000-memory.dmp

Download

memory/2944-25-0x0000000002B70000-0x0000000002B7A000-memory.dmp

Download

memory/2944-26-0x0000000008800000-0x0000000008E18000-memory.dmp

Download

memory/2944-27-0x0000000007A70000-0x0000000007B7A000-memory.dmp

Download

memory/2944-28-0x0000000007980000-0x0000000007992000-memory.dmp

Download

memory/2944-29-0x00000000079E0000-0x0000000007A1C000-memory.dmp

Download

memory/2944-30-0x0000000007A20000-0x0000000007A6C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads