mystic | 4ce71244da4dd5d9b0b7535c6b62aebf516adc87a36195170af93efa3a630b9f

Analysis

max time kernel
136s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe
Size

662KB
MD5

e26f2e8ea56b980e5f02ef404d34d67f
SHA1

ed2bb5bd36fd1d41d3f5212859f8500a83655459
SHA256

7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49
SHA512

7eb822186d7569ace7f013cdb773c959110c22793f50f15295ae953fa97d5119fe8301966bf725cac5efa6279951d3c6714376d8068648ddc06dc98a0a0fa387
SSDEEP

12288:MMrQy90VfuDBn/pbAhnEO8XO1adjxEhg0maYNCApdR7NCGB:syKuDBn/5JXYKiOVaYNCApdRIGB

Score

10^/10

mystic redline virad infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5443378.exe	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1713212.exe	family_redline
behavioral14/memory/1740-24-0x0000000000410000-0x0000000000440000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y7878993.exey1558758.exem5443378.exen1713212.exe

pid process

3012 y7878993.exe
3716 y1558758.exe
4204 m5443378.exe
1740 n1713212.exe

pid	process
3012	y7878993.exe
3716	y1558758.exe
4204	m5443378.exe
1740	n1713212.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exey7878993.exey1558758.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y7878993.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1558758.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exey7878993.exey1558758.exe

description	pid	process	target process
PID 4064 wrote to memory of 3012	4064	7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe	y7878993.exe
PID 4064 wrote to memory of 3012	4064	7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe	y7878993.exe
PID 4064 wrote to memory of 3012	4064	7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe	y7878993.exe
PID 3012 wrote to memory of 3716	3012	y7878993.exe	y1558758.exe
PID 3012 wrote to memory of 3716	3012	y7878993.exe	y1558758.exe
PID 3012 wrote to memory of 3716	3012	y7878993.exe	y1558758.exe
PID 3716 wrote to memory of 4204	3716	y1558758.exe	m5443378.exe
PID 3716 wrote to memory of 4204	3716	y1558758.exe	m5443378.exe
PID 3716 wrote to memory of 4204	3716	y1558758.exe	m5443378.exe
PID 3716 wrote to memory of 1740	3716	y1558758.exe	n1713212.exe
PID 3716 wrote to memory of 1740	3716	y1558758.exe	n1713212.exe
PID 3716 wrote to memory of 1740	3716	y1558758.exe	n1713212.exe

C:\Users\Admin\AppData\Local\Temp\7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe
"C:\Users\Admin\AppData\Local\Temp\7787b07a1719f5524402ec7cf71fb92a7177ee85b0a424e2b97f619ba2b32e49.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4064

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7878993.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7878993.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3012

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1558758.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1558758.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5443378.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5443378.exe
4⤵
- Executes dropped EXE
PID:4204

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1713212.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1713212.exe
4⤵
- Executes dropped EXE
PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y7878993.exe

Filesize
560KB

MD5
e814332ca2465d1d266059ea126de6d3

SHA1
696e0fae6397ffc47596e00a2d598d19446279f8

SHA256
2a72bfa310dc83f3c97c962cb9b54e481232e8631b9294c1a0d361baf8661208

SHA512
8abe26c9259d09338c1c2398d7c0ff5acd8f6256ae942819f8e5c9413f6a7259854b43b0167de2af5d673fb5cbd9c95281c717053883032481e295332f4dc6ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1558758.exe

Filesize
271KB

MD5
f02b8ab3927c5b11d162fc565310d175

SHA1
a748ae40716733900ce4e20879790565f37070f3

SHA256
6e1748a631938e7f963c5f5e9c469c646f9546d9d1ff7d6421fd7c721f763a4f

SHA512
961078fc01a352488d3af33c875617c87d9aef1587b14647568623047d35ac8f00f225789644d82efe0b5626cb92ce5feaf7bb0377cb3c98d31509f9e76b8d35

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5443378.exe

Filesize
142KB

MD5
a160e87508ed15322145314d0aa7705a

SHA1
f103bac29c73997fdabce012222c96ce59a68ff3

SHA256
13f5bb2f00e79391a8a7071888bb561fed27100d5fa2f458a86aeef011cbf40f

SHA512
53b50afc3e2389296a6822394eb4a35264d8f21465e072662eb887257ee39cc6ca4fc97a353e1b15e49bdaecb8ee847ca69de0acd38dc1b891358de720eb2e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n1713212.exe

Filesize
175KB

MD5
32b5d6a8be5487a08590f197da2f06c3

SHA1
3d661fdf9f56eefbe71b8457e560dbffe74415af

SHA256
9605f3208b022f50d39f014936bc076c0ab71dcdb1506b5ca9a3e5ad1f671ace

SHA512
30fddb3b59933ebcadd04f205afc192fb13a91c67b09803d6d8be8eb1542f9ffab013d5daf302e8fc29cbc63cfb40a41b5a5a6c37caabefcc0a4d33cb40c531b

Download Submit
memory/1740-24-0x0000000000410000-0x0000000000440000-memory.dmp

Filesize
192KB

Download
memory/1740-25-0x00000000027A0000-0x00000000027A6000-memory.dmp

Filesize
24KB

Download
memory/1740-26-0x000000000A7B0000-0x000000000ADC8000-memory.dmp

Filesize
6.1MB

Download
memory/1740-27-0x000000000A2A0000-0x000000000A3AA000-memory.dmp

Filesize
1.0MB

Download
memory/1740-28-0x000000000A1C0000-0x000000000A1D2000-memory.dmp

Filesize
72KB

Download
memory/1740-29-0x000000000A220000-0x000000000A25C000-memory.dmp

Filesize
240KB

Download
memory/1740-30-0x0000000002690000-0x00000000026DC000-memory.dmp

Filesize
304KB

Download