mystic | 4ce71244da4dd5d9b0b7535c6b62aebf516adc87a36195170af93efa3a630b9f

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe
Size

662KB
MD5

f13e775f414cc1ea88e79547d7f96311
SHA1

7bbcb6619cdd75734924bacc47c033e9fff787d8
SHA256

61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5
SHA512

b52cdca41d7279155917d0fca1ba4f7b155d2003fd7fff17dd1114828bedac186f870b01a7b77ad284d04e2b92bb46d6f89b1a7ed828fd9aaa395bca78ac2f7b
SSDEEP

12288:5MrQy90o19a0tahJoYcAzDQzhl1fBdoRorFVxx9PqEZ/8fISb8bgChvMnGLGQMVI:5y/NojoYcAfQzhtmReFlphSb8bhvMGlZ

Score

10^/10

mystic redline virad infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m1882534.exe	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9222196.exe	family_redline
behavioral12/memory/2940-24-0x0000000000FC0000-0x0000000000FF0000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

y9197044.exey1089076.exem1882534.exen9222196.exe

pid process

4296 y9197044.exe
1276 y1089076.exe
4396 m1882534.exe
2940 n9222196.exe

pid	process
4296	y9197044.exe
1276	y1089076.exe
4396	m1882534.exe
2940	n9222196.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exey9197044.exey1089076.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9197044.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y1089076.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exey9197044.exey1089076.exe

description	pid	process	target process
PID 2948 wrote to memory of 4296	2948	61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe	y9197044.exe
PID 2948 wrote to memory of 4296	2948	61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe	y9197044.exe
PID 2948 wrote to memory of 4296	2948	61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe	y9197044.exe
PID 4296 wrote to memory of 1276	4296	y9197044.exe	y1089076.exe
PID 4296 wrote to memory of 1276	4296	y9197044.exe	y1089076.exe
PID 4296 wrote to memory of 1276	4296	y9197044.exe	y1089076.exe
PID 1276 wrote to memory of 4396	1276	y1089076.exe	m1882534.exe
PID 1276 wrote to memory of 4396	1276	y1089076.exe	m1882534.exe
PID 1276 wrote to memory of 4396	1276	y1089076.exe	m1882534.exe
PID 1276 wrote to memory of 2940	1276	y1089076.exe	n9222196.exe
PID 1276 wrote to memory of 2940	1276	y1089076.exe	n9222196.exe
PID 1276 wrote to memory of 2940	1276	y1089076.exe	n9222196.exe

C:\Users\Admin\AppData\Local\Temp\61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe
"C:\Users\Admin\AppData\Local\Temp\61d857a52459b5cf9779c58c6ee28d8e2760da3fe873785eb0afcffa6b0680a5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9197044.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9197044.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1089076.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1089076.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m1882534.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m1882534.exe
      4⤵
      Executes dropped EXE
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9222196.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9222196.exe
      4⤵
      Executes dropped EXE
      PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9197044.exe

Filesize
560KB

MD5
0e4a69d60abb9453fd74c931a4aed8de

SHA1
29376d05f5eb6839a232a183624828af8297752a

SHA256
dba790fee7e08f2253cbefeddfcf47b5f743df466b2fab0f5810b061ea79d2cd

SHA512
964923a5d4b10c8cd4c715b3b7901dc06b47a837fc501e2c2a32f2a5c3c002b8964b6c53ca86a5616ea4d127b5e4d367cad8549a33d7f6ff36d563496b11f372

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1089076.exe

Filesize
271KB

MD5
acb5205c9259bde03fc38c61ba68fa55

SHA1
fea3b9794dfd5a9bd0bad13e1218ccdb66c8e2bd

SHA256
159350d0e0df13842e244f52dc92c4ee9b39e0584d2ae68116561daa90aae960

SHA512
fa9de6e7d7dcc12880780197ff8355cdc703621e37e78b9ed736ba23f7ee028d25cb0626dec32f4548d98e720ad18c30ccb56dbec944280b27b81a0b7162bd1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m1882534.exe

Filesize
141KB

MD5
70c37c72b3bbccb30785071ce749a430

SHA1
194ad91fbad6e695626c92eaa7d3006169c05df2

SHA256
3a3e207f6a4a61c6d0df8ab50f98ced800dfce8e401dde67e78afb1743f432f1

SHA512
6b5bf403a67a501ac419e4e8aa5980f27124931ea99f430755155c452d919591906b809e0284c890d8a2eebd2b5f1a7af8fc7adee7be24f488a7b6133887a9a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n9222196.exe

Filesize
175KB

MD5
069fd475017dcd61d6fb723c2185460a

SHA1
53e924db57596185af693713f2be065bbd4d965f

SHA256
0e967ef14c7c6110d658004caa394fb6cb008a9b6cb0d729556e90401da94a3d

SHA512
57f32a784bd37b967f4e03cc79e5710edd2363e3dc6da33841db9354b3a93f4d9743c8ab4e43ddc78b4245d512fd8d42264a8dc6f7631192d4088dd01c3889fe

Download Submit
memory/2940-24-0x0000000000FC0000-0x0000000000FF0000-memory.dmp

Filesize
192KB

Download
memory/2940-25-0x00000000057E0000-0x00000000057E6000-memory.dmp

Filesize
24KB

Download
memory/2940-26-0x000000000B2E0000-0x000000000B8F8000-memory.dmp

Filesize
6.1MB

Download
memory/2940-27-0x000000000AE30000-0x000000000AF3A000-memory.dmp

Filesize
1.0MB

Download
memory/2940-28-0x000000000AD70000-0x000000000AD82000-memory.dmp

Filesize
72KB

Download
memory/2940-29-0x000000000ADD0000-0x000000000AE0C000-memory.dmp

Filesize
240KB

Download
memory/2940-30-0x00000000052D0000-0x000000000531C000-memory.dmp

Filesize
304KB

Download