mystic | 1aa612c673e0e8506776c3b8740894f0947bb33bd7b5f22dc14212289801a024

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe
Size

649KB
MD5

2917f39014ba3a0e8e686ef68abf591b
SHA1

fa2cce397304267efc3adf4fad5de282666f0382
SHA256

79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588
SHA512

02c83b5db0933a1041bb09417bfbfac7184bdf7ab9431a131758d7f10c6592ab7422f2761c0a6c60279786bb13c5c4aded52f0767cf40e6efb14b20abbad229b
SSDEEP

12288:yMrny90yN98tmrgjStMHu3JdoVNR0y5LQpZ77BL3UOfajJw5T8/:dyp8GcaMO3JmVDU77l3laq5w/

Score

10^/10

mystic redline virad infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral12/files/0x000800000002341a-19.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x000700000002341b-22.dat	family_redline
behavioral12/memory/4700-24-0x0000000000210000-0x0000000000240000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1812	y1267462.exe
3736	y5421879.exe
3720	m5269619.exe
4700	n6761123.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y1267462.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y5421879.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 1812	1960	79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe	83
PID 1960 wrote to memory of 1812	1960	79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe	83
PID 1960 wrote to memory of 1812	1960	79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe	83
PID 1812 wrote to memory of 3736	1812	y1267462.exe	84
PID 1812 wrote to memory of 3736	1812	y1267462.exe	84
PID 1812 wrote to memory of 3736	1812	y1267462.exe	84
PID 3736 wrote to memory of 3720	3736	y5421879.exe	85
PID 3736 wrote to memory of 3720	3736	y5421879.exe	85
PID 3736 wrote to memory of 3720	3736	y5421879.exe	85
PID 3736 wrote to memory of 4700	3736	y5421879.exe	86
PID 3736 wrote to memory of 4700	3736	y5421879.exe	86
PID 3736 wrote to memory of 4700	3736	y5421879.exe	86

C:\Users\Admin\AppData\Local\Temp\79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe
"C:\Users\Admin\AppData\Local\Temp\79920d9e9cb9d0d34dea9a437201a5436392c8af727314332ebf8e3e0f45a588.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1267462.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1267462.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5421879.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5421879.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5269619.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5269619.exe
      4⤵
      Executes dropped EXE
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6761123.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6761123.exe
      4⤵
      Executes dropped EXE
      PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1267462.exe

Filesize
547KB

MD5
058fbae07ae4ebad00fcf60a5a5e2137

SHA1
77788bd27c71b74253557c0e09facf0d842c4e87

SHA256
50ab436b8b2c11f6e999eaaed4fae1a36525aeb3282a9d57840af32f6b74eedf

SHA512
d85669c641eadb4011a8007892f10bf503b163f360b4d2df9a33ce4d38ba8746567ba6551aa6773213d73545e72e065dc7484d894d0804493383b9e8a3b74834

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y5421879.exe

Filesize
271KB

MD5
4ad462c2955d05dcddb69f4ca8d8b504

SHA1
fce5d821b79e9c448664c694e12661d73819e46a

SHA256
64f004d4a260338ba4eea50516df52087bab791fd6eb50d0b4eb189e6e13bb36

SHA512
fc96ff0c391a66600703ef957ca9d1a9e4b126b3a001e12e8c9f40ae363a5a8c473899ed8a929edb9268e23aa342284d80abeab64b3340ac3b655943331d3624

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5269619.exe

Filesize
140KB

MD5
5ec4db0dd00a578ff42c721f4af96543

SHA1
050d32ef5ec09bf8849edc51d9357d676c5e84e2

SHA256
9a6dcac78ec279de8aab5445fdab7fd80d2d96f5bf458860be17174798aedca0

SHA512
accb8dc3bc5bbd95d78a1857d7087e7e8001fe53395904dcc896456f01c5d78b3ec53e051ca4d595681bfecd9eb846568b39b47218d6008940e6871da028a3ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n6761123.exe

Filesize
174KB

MD5
e786f7b019bb0b14ecf6ce028af0dafc

SHA1
a817380b0dcdcd396fb53b92f85a599254de2df5

SHA256
c4d3477c71d1e86b5cab3bfacc65937b102cf138d90e6d213bf1823e099e9bb0

SHA512
2e26c31517e0d6a13e92f55fb116db6c6e9ebb4afa48d4590a815264c99557cf30718b016e2a88590e13d8af672adf815f7886cded33073d05846c96963bcedd

Download Submit
memory/4700-24-0x0000000000210000-0x0000000000240000-memory.dmp

Filesize
192KB

Download
memory/4700-25-0x0000000004B30000-0x0000000004B36000-memory.dmp

Filesize
24KB

Download
memory/4700-26-0x000000000A690000-0x000000000ACA8000-memory.dmp

Filesize
6.1MB

Download
memory/4700-27-0x000000000A1C0000-0x000000000A2CA000-memory.dmp

Filesize
1.0MB

Download
memory/4700-28-0x000000000A100000-0x000000000A112000-memory.dmp

Filesize
72KB

Download
memory/4700-29-0x000000000A160000-0x000000000A19C000-memory.dmp

Filesize
240KB

Download
memory/4700-30-0x0000000004670000-0x00000000046BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads