mystic | 5e831beab1114ac9acd665a6dc93e4478c72f9985bcae804c34864e3b6ee4705

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe
Size

884KB
MD5

1f64d4e95e750972b6ca8da2ca7f200e
SHA1

095a309f4b1051dfd077467f53898401614dd5e8
SHA256

e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d
SHA512

024e0f80fbdfd0c55b1ffdb782454dbfd5be9facb112fb0bc11c154a227b99a4d9ee512a17e899c58caf7227a4220b464cc4587e694e02675844cdbb5fb071de
SSDEEP

12288:sMrZy90kiPcGG6NV0d9/E+x6diexj8ZEoubki62Cd2Y8QJS3B8s6v:dyLGGq0d9/E+Rw8ZEoubki6dLPS3DO

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral18/memory/392-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral18/memory/392-24-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral18/memory/392-22-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xg494Yp.exe	family_redline
behavioral18/memory/3576-28-0x00000000008F0000-0x000000000092E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

UA0dr1jB.exeLM8lO9hX.exe1Nh04DF3.exe2xg494Yp.exe

pid process

3536 UA0dr1jB.exe
1668 LM8lO9hX.exe
1988 1Nh04DF3.exe
3576 2xg494Yp.exe

pid	process
3536	UA0dr1jB.exe
1668	LM8lO9hX.exe
1988	1Nh04DF3.exe
3576	2xg494Yp.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

UA0dr1jB.exeLM8lO9hX.exee4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	UA0dr1jB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	LM8lO9hX.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1Nh04DF3.exe

description pid process target process

PID 1988 set thread context of 392 1988 1Nh04DF3.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4008 1988 WerFault.exe 1Nh04DF3.exe

description	pid	process	target process
PID 1988 set thread context of 392	1988	1Nh04DF3.exe	AppLaunch.exe

pid	pid_target	process	target process
4008	1988	WerFault.exe	1Nh04DF3.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exeUA0dr1jB.exeLM8lO9hX.exe1Nh04DF3.exe

description	pid	process	target process
PID 2316 wrote to memory of 3536	2316	e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe	UA0dr1jB.exe
PID 2316 wrote to memory of 3536	2316	e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe	UA0dr1jB.exe
PID 2316 wrote to memory of 3536	2316	e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe	UA0dr1jB.exe
PID 3536 wrote to memory of 1668	3536	UA0dr1jB.exe	LM8lO9hX.exe
PID 3536 wrote to memory of 1668	3536	UA0dr1jB.exe	LM8lO9hX.exe
PID 3536 wrote to memory of 1668	3536	UA0dr1jB.exe	LM8lO9hX.exe
PID 1668 wrote to memory of 1988	1668	LM8lO9hX.exe	1Nh04DF3.exe
PID 1668 wrote to memory of 1988	1668	LM8lO9hX.exe	1Nh04DF3.exe
PID 1668 wrote to memory of 1988	1668	LM8lO9hX.exe	1Nh04DF3.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1988 wrote to memory of 392	1988	1Nh04DF3.exe	AppLaunch.exe
PID 1668 wrote to memory of 3576	1668	LM8lO9hX.exe	2xg494Yp.exe
PID 1668 wrote to memory of 3576	1668	LM8lO9hX.exe	2xg494Yp.exe
PID 1668 wrote to memory of 3576	1668	LM8lO9hX.exe	2xg494Yp.exe

C:\Users\Admin\AppData\Local\Temp\e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe
"C:\Users\Admin\AppData\Local\Temp\e4e49b8568937c43bba5621fcfe9e3762efb9c4078b3287603ef249c522d126d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2316

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UA0dr1jB.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UA0dr1jB.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3536

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LM8lO9hX.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LM8lO9hX.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Nh04DF3.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Nh04DF3.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 152
5⤵
- Program crash
PID:4008

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xg494Yp.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xg494Yp.exe
4⤵
- Executes dropped EXE
PID:3576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1988 -ip 1988
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UA0dr1jB.exe
Filesize
590KB

MD5
51c4e08e66ba110fc409dd29756663a9

SHA1
eebcc81a6df9af1f9f83338cd4025581063cba16

SHA256
9a0c968ae1804661c5bef3200fe2981f14f49e385f32f398316f57620825d0a3

SHA512
0adcf46abf851327e0dcbde29f0cbb4ac2a8edb6409dc3656200859c63b1e9a45809bd34ed2ac0d4c8b6fa56a2448bde37af15772b2b18c93a040efaae1466c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LM8lO9hX.exe
Filesize
417KB

MD5
ed39b18378f94c9be599adcabf326d5e

SHA1
242a649a528bfe33d35032338737d9d80d54ddc0

SHA256
0289e8beece7f929ee4f1866f135bf6643fc3acb7b1d8f032344a8ea80b0a508

SHA512
658c269a273ad03f4b8767d98c09308073a666d99d6efe815d0dd2b2d48d004392e5eda174084bc0fa87b48f39d4a89a4824c5018431ad147e1d611aca3e7a10

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Nh04DF3.exe
Filesize
378KB

MD5
f0831f173733de08511f3a0739f278a6

SHA1
06dc809d653c5d2c97386084ae13b50a73eb5b60

SHA256
8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

SHA512
19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xg494Yp.exe
Filesize
231KB

MD5
3ad22e3c5ba832c17ae0ce322cdfa8bc

SHA1
c8d4b98f62698287ae004a8f73612d7080ac0416

SHA256
2b56240abd8cc504dafbd738f0e52a21e3e0a4b82b74eb32848cf58feef71fe3

SHA512
6fac06c77feda96873aa406e349487f248760b15ac011902b20ac0a7c4e799e4064806ff5f043405ddfe060cda8d6e20ef84dbf554debcb4cfeeb892133b2b81

Download Submit
memory/392-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/392-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/392-22-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3576-29-0x0000000007D00000-0x00000000082A4000-memory.dmp

Filesize
5.6MB

Download
memory/3576-28-0x00000000008F0000-0x000000000092E000-memory.dmp

Filesize
248KB

Download
memory/3576-30-0x00000000077F0000-0x0000000007882000-memory.dmp

Filesize
584KB

Download
memory/3576-31-0x0000000004DC0000-0x0000000004DCA000-memory.dmp

Filesize
40KB

Download
memory/3576-32-0x00000000088D0000-0x0000000008EE8000-memory.dmp

Filesize
6.1MB

Download
memory/3576-33-0x0000000007BA0000-0x0000000007CAA000-memory.dmp

Filesize
1.0MB

Download
memory/3576-34-0x00000000078E0000-0x00000000078F2000-memory.dmp

Filesize
72KB

Download
memory/3576-35-0x0000000007A40000-0x0000000007A7C000-memory.dmp

Filesize
240KB

Download
memory/3576-36-0x0000000007A90000-0x0000000007ADC000-memory.dmp

Filesize
304KB

Download