mystic | 4ce71244da4dd5d9b0b7535c6b62aebf516adc87a36195170af93efa3a630b9f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe
Size

884KB
MD5

aee5889d7a6e3bb9b8e7d8989b2b4bdd
SHA1

12567494309369bb902bf4d13f66a6c57ff6149d
SHA256

3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8
SHA512

2e85c20244c3a51c762076fedcacb87c32af1702da61c1db00889736781c64eaaf03dc44dd9f6219155886bf899a90f17db1ee49ef29c6b035f4b1d5dc6f316c
SSDEEP

24576:Yya3DjTupxvL1Y8/4+oT0NHxlU7ppd0dm:fa3DjTup5e8g30ofk

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral8/memory/2364-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/2364-23-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/2364-24-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2QR966ET.exe	family_redline
behavioral8/memory/2032-28-0x00000000005A0000-0x00000000005DE000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

Vb2Nb0zR.exeeq4yI0eE.exe1mr53WH1.exe2QR966ET.exe

pid process

2396 Vb2Nb0zR.exe
1540 eq4yI0eE.exe
4284 1mr53WH1.exe
2032 2QR966ET.exe

pid	process
2396	Vb2Nb0zR.exe
1540	eq4yI0eE.exe
4284	1mr53WH1.exe
2032	2QR966ET.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Vb2Nb0zR.exeeq4yI0eE.exe3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Vb2Nb0zR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	eq4yI0eE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1mr53WH1.exe

description pid process target process

PID 4284 set thread context of 2364 4284 1mr53WH1.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2556 4284 WerFault.exe 1mr53WH1.exe

description	pid	process	target process
PID 4284 set thread context of 2364	4284	1mr53WH1.exe	AppLaunch.exe

pid	pid_target	process	target process
2556	4284	WerFault.exe	1mr53WH1.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exeVb2Nb0zR.exeeq4yI0eE.exe1mr53WH1.exe

description	pid	process	target process
PID 3948 wrote to memory of 2396	3948	3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe	Vb2Nb0zR.exe
PID 3948 wrote to memory of 2396	3948	3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe	Vb2Nb0zR.exe
PID 3948 wrote to memory of 2396	3948	3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe	Vb2Nb0zR.exe
PID 2396 wrote to memory of 1540	2396	Vb2Nb0zR.exe	eq4yI0eE.exe
PID 2396 wrote to memory of 1540	2396	Vb2Nb0zR.exe	eq4yI0eE.exe
PID 2396 wrote to memory of 1540	2396	Vb2Nb0zR.exe	eq4yI0eE.exe
PID 1540 wrote to memory of 4284	1540	eq4yI0eE.exe	1mr53WH1.exe
PID 1540 wrote to memory of 4284	1540	eq4yI0eE.exe	1mr53WH1.exe
PID 1540 wrote to memory of 4284	1540	eq4yI0eE.exe	1mr53WH1.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 4284 wrote to memory of 2364	4284	1mr53WH1.exe	AppLaunch.exe
PID 1540 wrote to memory of 2032	1540	eq4yI0eE.exe	2QR966ET.exe
PID 1540 wrote to memory of 2032	1540	eq4yI0eE.exe	2QR966ET.exe
PID 1540 wrote to memory of 2032	1540	eq4yI0eE.exe	2QR966ET.exe

C:\Users\Admin\AppData\Local\Temp\3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe
"C:\Users\Admin\AppData\Local\Temp\3c47d4d72a38e9bc6761e47d9e0e51429f2c67ffdd939c07a664efe29c9cd5e8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3948

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vb2Nb0zR.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vb2Nb0zR.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2396

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eq4yI0eE.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eq4yI0eE.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1mr53WH1.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1mr53WH1.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:2364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 152
5⤵
- Program crash
PID:2556

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2QR966ET.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2QR966ET.exe
4⤵
- Executes dropped EXE
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4284 -ip 4284
1⤵
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vb2Nb0zR.exe
Filesize
590KB

MD5
b35f3858aa1170e2f95ec1c4b3261bd6

SHA1
a039c19ce6e7b23eb63f353612f0d50e8ad8bf3a

SHA256
271c94f6bca64d703ef5ac1bc9fabf62fa9450877570b9aa432be14bea668801

SHA512
169195a7b28112c54ba7e5056a9c56bacfc786abdcd0ba394c6f479e603ed447e239013aec15e82d78390c0a4e38760c582b43053570d5e3e35b74451722d586

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\eq4yI0eE.exe
Filesize
417KB

MD5
e5b8819ec3bfdb4f9d0d1660cfd09f33

SHA1
83e4326fd253165d1e82bfe1cf437a53d4f1f4e0

SHA256
6dc9cfd058ef5ddbcfeee6c32e8c6d968cfba7b8a78a020fa30abd612bd964f4

SHA512
25f55829bc69303fda0e0d3fdf4bad33c5c85b40ff6690fce48396a77c7e4256390d09bb48b375568b4556aca1bb498edf09596efade7c2fc1a5260c5583e298

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1mr53WH1.exe
Filesize
378KB

MD5
f0831f173733de08511f3a0739f278a6

SHA1
06dc809d653c5d2c97386084ae13b50a73eb5b60

SHA256
8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

SHA512
19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2QR966ET.exe
Filesize
231KB

MD5
0ba419dcb5dbcc474a6fa77ebee93be4

SHA1
060e768553a44694e4ac882ec96f5d309c47645c

SHA256
0aa9c3d925b98c3a3b242a22f44dc5e0a194b397b1aebd621265273b93b3d965

SHA512
e07cec9203fd002e2e51cb85c571bf164540cf46e0510d23aeb8a1dcbe31bb862f4fb8a8d842e0f3cbe228164dec2087f7213f5fc1af36607f2c1863a1e126fe

Download Submit
memory/2032-33-0x0000000007EB0000-0x0000000007FBA000-memory.dmp

Filesize
1.0MB

Download
memory/2032-28-0x00000000005A0000-0x00000000005DE000-memory.dmp

Filesize
248KB

Download
memory/2032-29-0x0000000007900000-0x0000000007EA4000-memory.dmp

Filesize
5.6MB

Download
memory/2032-30-0x0000000007350000-0x00000000073E2000-memory.dmp

Filesize
584KB

Download
memory/2032-31-0x00000000049A0000-0x00000000049AA000-memory.dmp

Filesize
40KB

Download
memory/2032-32-0x00000000084D0000-0x0000000008AE8000-memory.dmp

Filesize
6.1MB

Download
memory/2032-34-0x00000000074B0000-0x00000000074C2000-memory.dmp

Filesize
72KB

Download
memory/2032-35-0x0000000007510000-0x000000000754C000-memory.dmp

Filesize
240KB

Download
memory/2032-36-0x0000000007790000-0x00000000077DC000-memory.dmp

Filesize
304KB

Download
memory/2364-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2364-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2364-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download