mystic | 1aa612c673e0e8506776c3b8740894f0947bb33bd7b5f22dc14212289801a024

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe
Size

662KB
MD5

550d6c9a76a063cdea263f9e44040e91
SHA1

54d122af56e4d6fb09862bf03336e41dc57600be
SHA256

27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223
SHA512

3cb8554906ee1cfd43b426d557594665fd661c8299719c077e12a18747b86f5a74b867751d7e1c9ece13cf9b2f548b0ef4e25018f56144db24b3236c06acc19d
SSDEEP

12288:3MrUy909SFjJjwVZca4uMJNe4++YO5704Y69JRwfvSAvbno:LyeSFWV6a4rDXW6dwiAvs

Score

10^/10

mystic redline virad infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral5/files/0x00080000000233e1-19.dat	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x00070000000233e2-22.dat	family_redline
behavioral5/memory/2120-24-0x00000000002C0000-0x00000000002F0000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
2668	y4430792.exe
3040	y7459640.exe
4936	m8049681.exe
2120	n5533734.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y4430792.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	y7459640.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 2668	4524	27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe	82
PID 4524 wrote to memory of 2668	4524	27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe	82
PID 4524 wrote to memory of 2668	4524	27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe	82
PID 2668 wrote to memory of 3040	2668	y4430792.exe	83
PID 2668 wrote to memory of 3040	2668	y4430792.exe	83
PID 2668 wrote to memory of 3040	2668	y4430792.exe	83
PID 3040 wrote to memory of 4936	3040	y7459640.exe	84
PID 3040 wrote to memory of 4936	3040	y7459640.exe	84
PID 3040 wrote to memory of 4936	3040	y7459640.exe	84
PID 3040 wrote to memory of 2120	3040	y7459640.exe	85
PID 3040 wrote to memory of 2120	3040	y7459640.exe	85
PID 3040 wrote to memory of 2120	3040	y7459640.exe	85

C:\Users\Admin\AppData\Local\Temp\27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe
"C:\Users\Admin\AppData\Local\Temp\27bb9fb2c486b6d1b245b9d1a80523ce3a661b3d9eb71a8772747a0cc4a12223.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4430792.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4430792.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7459640.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7459640.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m8049681.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m8049681.exe
      4⤵
      Executes dropped EXE
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5533734.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5533734.exe
      4⤵
      Executes dropped EXE
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y4430792.exe

Filesize
560KB

MD5
15b2d35ce7a91c0a834ef44cbcd8025e

SHA1
f8e6ad4b8c5119b8674d260becdd54469bcf2195

SHA256
2afd7e76341ec86a6f5ae8b7f48cde968bef9695dd61123c610d942a67cea377

SHA512
e8b995dddeacb4250e957f1bfcb099631be03c707c85384c5057f40f91657ee9f2b4b0e936eea5a0ce41d6b5729e17f01a4d9bd1aa6d00545064ebdef29479cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y7459640.exe

Filesize
271KB

MD5
e6a5ad84cd7be1b93a35c8941faf7b46

SHA1
6e1f3194d89ea7e938936d527139ee0460fcba94

SHA256
120010dc910687d188afcc5c24641f71be59e11f3ad1fdf000148acdb63a507c

SHA512
18ab55ab216890d19e83489fb3948598ada0b6780c53c47c50448123b0a284f0fda1fa4974ca524289af5d2518655f38d143d7b75fd6650ee5b228eb869f92e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\m8049681.exe

Filesize
141KB

MD5
be43aa2855feb2737608e703d988bcda

SHA1
62f0472005b9f948beeaec978de5b66765e964fb

SHA256
e89e85d2cb57bf70b256da7542dac95885b4e293b54398e66a981097a5b09314

SHA512
bd72e22dec3b760174a740437ce27a5b58d5e060e85f54c59d75930487d74f9153ba06b1ad227df8ad2b01de2fab96960326295e5f58c3e3582c245f3f908a62

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\n5533734.exe

Filesize
175KB

MD5
42da40730f06da8ff99d597ce527a66c

SHA1
8d9488681e39cddc7f74fbc5e6a8dc7012478b10

SHA256
feba3b6e563e2218a98377e2bd1562d3fd61ad754f3855e8f95e91c257e20d37

SHA512
bf72ea9e75eb7567a6ad14c29ecd1978e9001e72d83106c6211eb2bbe11687520446ecee7766cb673229e6540122603602c7ff0727aff30648817d2f382b7bf1

Download Submit
memory/2120-24-0x00000000002C0000-0x00000000002F0000-memory.dmp

Filesize
192KB

Download
memory/2120-25-0x0000000000C00000-0x0000000000C06000-memory.dmp

Filesize
24KB

Download
memory/2120-26-0x0000000005330000-0x0000000005948000-memory.dmp

Filesize
6.1MB

Download
memory/2120-27-0x0000000004E50000-0x0000000004F5A000-memory.dmp

Filesize
1.0MB

Download
memory/2120-28-0x0000000004D90000-0x0000000004DA2000-memory.dmp

Filesize
72KB

Download
memory/2120-29-0x0000000004DF0000-0x0000000004E2C000-memory.dmp

Filesize
240KB

Download
memory/2120-30-0x0000000004F60000-0x0000000004FAC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads