mystic | b0707ded6960936877cf4a2a4a5a7191894ea5c19ee70296e7004b5431f5044e

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 09:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Size

759KB
MD5

b69c615e91840a82076fe1dc0175cd5c
SHA1

bb23d10b27c9fb45af61d9414f31944bbfd6d62b
SHA256

6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6
SHA512

5a4aa247c3bb6167c03c050c2899f8a669c3835a93ee16509dfbeb2f06eae38b4cec1e3c8a5efc65e8df2eba665c1f42b85b192edd3fb2f7d1ce43761d134c90
SSDEEP

12288:4MrMy90OPICz9hQnKZKC5Z7O9mpz53ClrunebLXR0prExFgUI24a211bt:kyrPJQKZKC5ZCkz5SRunebLB0p3UH4ao

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral8/memory/544-14-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/544-16-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/544-15-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral8/memory/544-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000700000002342c-20.dat	family_redline
behavioral8/memory/2944-22-0x00000000009C0000-0x00000000009FE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
516	En4Gf9Pe.exe
2492	1uj82fO7.exe
2944	2GV644kk.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	En4Gf9Pe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 544	2492	1uj82fO7.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3888	544	WerFault.exe	88

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 516	4576	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	83
PID 4576 wrote to memory of 516	4576	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	83
PID 4576 wrote to memory of 516	4576	6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe	83
PID 516 wrote to memory of 2492	516	En4Gf9Pe.exe	84
PID 516 wrote to memory of 2492	516	En4Gf9Pe.exe	84
PID 516 wrote to memory of 2492	516	En4Gf9Pe.exe	84
PID 2492 wrote to memory of 2208	2492	1uj82fO7.exe	86
PID 2492 wrote to memory of 2208	2492	1uj82fO7.exe	86
PID 2492 wrote to memory of 2208	2492	1uj82fO7.exe	86
PID 2492 wrote to memory of 2624	2492	1uj82fO7.exe	87
PID 2492 wrote to memory of 2624	2492	1uj82fO7.exe	87
PID 2492 wrote to memory of 2624	2492	1uj82fO7.exe	87
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 2492 wrote to memory of 544	2492	1uj82fO7.exe	88
PID 516 wrote to memory of 2944	516	En4Gf9Pe.exe	90
PID 516 wrote to memory of 2944	516	En4Gf9Pe.exe	90
PID 516 wrote to memory of 2944	516	En4Gf9Pe.exe	90

C:\Users\Admin\AppData\Local\Temp\6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe
"C:\Users\Admin\AppData\Local\Temp\6ab7739b7f0b5cc84bf55cd6f09beb3d4860ec6428202c54e8e023161020c8d6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2208
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2624
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 540
        5⤵
        Program crash
        
        PID:3888
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe
    3⤵
    - Executes dropped EXE
    PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 544 -ip 544
1⤵
PID:4248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\En4Gf9Pe.exe

Filesize
562KB

MD5
b062259b5db02d3f43088b71fc2efeb5

SHA1
83d8cf252d4bda4af35074676577df6dcb89355b

SHA256
2dc87d1a3ce91494e1e59b6b06c1e26d6d3149e46465bae9d5cf72d4d9316567

SHA512
fc3f13a6265fb9fda48f574853f8581ba0a08e48746c0729ec1b2d10202cb37780c9dfcb21f774f598b2921e59fdcae1d71534378ef34c5a2831d3426af27d4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uj82fO7.exe

Filesize
1.1MB

MD5
cf8a8afe6b52833ef82cbe9d5742082d

SHA1
ac2de55f6d4f189ce18ecd2adc792fea4f14c624

SHA256
c83b3837583a5fe78c1ba95e3b5785023550c02c2940664725c2b8e2a5eabf34

SHA512
e273917afb1cc984cea1d1573938aae1fcf7ccfa2edecaa3643e5b288e517c66228624359f93a6e38cd3ce284d20c217b802ac532a1253532b5ad21fbf2400d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2GV644kk.exe

Filesize
222KB

MD5
80b7f3f936cef5ca29f7b5db2e093cec

SHA1
47706281df477fbc57e9cdbb5f43c0b868950950

SHA256
80bd0280b2703d0f67159a20f3eda6f06e69f1d7da5023d8a9670325e10e8c23

SHA512
b048e15acc0d34b464f660c09979c25c09dc646d6ecfccb1835e451e574bca155495859a31ef1785ed7c178fcf4e04b015c774200887440e2e00cea457b34854

Download Submit
memory/544-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/544-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/544-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/544-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2944-23-0x0000000007C30000-0x00000000081D4000-memory.dmp

Filesize
5.6MB

Download
memory/2944-22-0x00000000009C0000-0x00000000009FE000-memory.dmp

Filesize
248KB

Download
memory/2944-24-0x0000000007760000-0x00000000077F2000-memory.dmp

Filesize
584KB

Download
memory/2944-25-0x0000000002B70000-0x0000000002B7A000-memory.dmp

Filesize
40KB

Download
memory/2944-26-0x0000000008800000-0x0000000008E18000-memory.dmp

Filesize
6.1MB

Download
memory/2944-27-0x0000000007A70000-0x0000000007B7A000-memory.dmp

Filesize
1.0MB

Download
memory/2944-28-0x0000000007980000-0x0000000007992000-memory.dmp

Filesize
72KB

Download
memory/2944-29-0x00000000079E0000-0x0000000007A1C000-memory.dmp

Filesize
240KB

Download
memory/2944-30-0x0000000007A20000-0x0000000007A6C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads