mystic | 1aa612c673e0e8506776c3b8740894f0947bb33bd7b5f22dc14212289801a024

Analysis

max time kernel
133s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe
Size

649KB
MD5

8f5a80f4aee9459c4c228b1efcf8dc0d
SHA1

dfc8371c59dac97dd00bff885bee72003807d1dc
SHA256

fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019
SHA512

88e2ec8d299fe08f773045259a378cf776382fd56e989fdc8ddb5113327aa15b8c4b88c1d15b31a8d42530e366412d34e98e8a5cd106310cdd4abb24b8bcb324
SSDEEP

12288:wMrzy90UAJ0lQk/aDACA0ZuFHmci4roooSdZH+k4FvbKSoggLB1PUNcO:Ty4D8a830cFzrlXdZek4FdNgLB1cl

Score

10^/10

mystic redline virad infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral19/files/0x00080000000235d8-20.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral19/files/0x00070000000235d9-22.dat	family_redline
behavioral19/memory/4116-24-0x0000000000A60000-0x0000000000A90000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
5112	y9137950.exe
2328	y2772997.exe
3876	m5918346.exe
4116	n8924738.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y2772997.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y9137950.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 5112	2112	fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe	91
PID 2112 wrote to memory of 5112	2112	fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe	91
PID 2112 wrote to memory of 5112	2112	fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe	91
PID 5112 wrote to memory of 2328	5112	y9137950.exe	92
PID 5112 wrote to memory of 2328	5112	y9137950.exe	92
PID 5112 wrote to memory of 2328	5112	y9137950.exe	92
PID 2328 wrote to memory of 3876	2328	y2772997.exe	93
PID 2328 wrote to memory of 3876	2328	y2772997.exe	93
PID 2328 wrote to memory of 3876	2328	y2772997.exe	93
PID 2328 wrote to memory of 4116	2328	y2772997.exe	94
PID 2328 wrote to memory of 4116	2328	y2772997.exe	94
PID 2328 wrote to memory of 4116	2328	y2772997.exe	94

C:\Users\Admin\AppData\Local\Temp\fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe
"C:\Users\Admin\AppData\Local\Temp\fb618de176f20e02e8f9667fd9ce9737e7d541243fbb879127b2f1728ea15019.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9137950.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9137950.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2772997.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2772997.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5918346.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5918346.exe
      4⤵
      Executes dropped EXE
      PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n8924738.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n8924738.exe
      4⤵
      Executes dropped EXE
      PID:4116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4028,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y9137950.exe

Filesize
547KB

MD5
121980eafceea5103b8636ad8630d391

SHA1
88ae7dd71504369ed8ae9ab1a875b26ac98ea569

SHA256
ac7b643ffef4c28a2845f77272341a1296fbc48821d3bcb12042da60778575e3

SHA512
696771ed8cfcd3ed0eb5af4f1a42bf52f54de730131a06be4aae34232f3989f0cd8dbd0f30b9dd094b19b250e53f8b077d9cf2182e512e5598076b3d4fbd175a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y2772997.exe

Filesize
271KB

MD5
ee84e347fe7ba2b972a981b6799e38b8

SHA1
7d1bbd5c8ee2aeb43276e8ad6a32b009c9f48eb1

SHA256
9e86857a1d51a4b16ade0e4aca772ea754be2836bc872a6536c6ea3e7cf9260e

SHA512
b6c42216d9f1abaacbd7b43aa39b05b319bd55deff94bcb40e19d316f4f1b53adca20a85d0ace546832f4a21eff318ae666e6e03a1980dddfdb90fd875bdd35e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m5918346.exe

Filesize
140KB

MD5
f24327d77cc80fcc87464b43ecff87ae

SHA1
355f27152f2e6dd09af253621a43837542c42d25

SHA256
b7567bf08fcbdd44df101b8e4ade863d1afa9dd6c643bd28a506116f8db33a92

SHA512
f1bf4fb8d15dec3bdfe68398cf69674fc840cccfe8712b9d27c059c97df1e985c88e28bf4837ee9bac7a93e8486d618e719de3f56ca7891e7a58e2cfda51b2d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n8924738.exe

Filesize
174KB

MD5
51ee9840b1149394db1ec91b4a3e00ca

SHA1
806feb63381fca5a41f1f50f9cbc4fc017da18af

SHA256
60765574d34bbf8700fb032847726fb58c6871ec5741e365f1c5c3e9df5a13d7

SHA512
4eac396604e4690085d15f8fae4245b8b531ae89d3acc1a95d81ff18e98146db4aa8f4d3314f14f9fad9d177d6127bdded4badedf4a59c290a8111ac67a0eb63

Download Submit
memory/4116-24-0x0000000000A60000-0x0000000000A90000-memory.dmp

Filesize
192KB

Download
memory/4116-25-0x0000000002D90000-0x0000000002D96000-memory.dmp

Filesize
24KB

Download
memory/4116-26-0x0000000005AA0000-0x00000000060B8000-memory.dmp

Filesize
6.1MB

Download
memory/4116-27-0x0000000005590000-0x000000000569A000-memory.dmp

Filesize
1.0MB

Download
memory/4116-28-0x00000000052E0000-0x00000000052F2000-memory.dmp

Filesize
72KB

Download
memory/4116-29-0x0000000005480000-0x00000000054BC000-memory.dmp

Filesize
240KB

Download
memory/4116-30-0x00000000054C0000-0x000000000550C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads