mystic | 5e831beab1114ac9acd665a6dc93e4478c72f9985bcae804c34864e3b6ee4705

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe
Size

555KB
MD5

ea43b1e59f0160ff70286c6aea7da9c1
SHA1

009ea9a8840d10aec2489e2ffe070cb7b983f3c5
SHA256

e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba
SHA512

42b0a9438daa925b6e635966e96907eebbceb37f4aafa5e0efeaccf1b8f4baa48b454b8a884a2ad941f442ed48cfe7c324054355160218ab3cb4326c5fd11bf7
SSDEEP

12288:nMrIy90dqDOSINkCQvCLFF7d8OII9tPcS7phJHa3:HypDmNkCK2pRd9tP7BHa3

Score

10^/10

mystic redline virad infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

virad

77.91.124.82:19071

Attributes

auth_value
434dd63619ca8bbf10125913fb40ca28

Signatures

Detect Mystic stealer payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0094992.exe	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n6589525.exe	family_redline
behavioral19/memory/2544-18-0x0000000000C20000-0x0000000000C50000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

y3622416.exem0094992.exen6589525.exe

pid process

1368 y3622416.exe
4616 m0094992.exe
2544 n6589525.exe

pid	process
1368	y3622416.exe
4616	m0094992.exe
2544	n6589525.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exey3622416.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	y3622416.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exey3622416.exe

description	pid	process	target process
PID 2480 wrote to memory of 1368	2480	e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe	y3622416.exe
PID 2480 wrote to memory of 1368	2480	e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe	y3622416.exe
PID 2480 wrote to memory of 1368	2480	e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe	y3622416.exe
PID 1368 wrote to memory of 4616	1368	y3622416.exe	m0094992.exe
PID 1368 wrote to memory of 4616	1368	y3622416.exe	m0094992.exe
PID 1368 wrote to memory of 4616	1368	y3622416.exe	m0094992.exe
PID 1368 wrote to memory of 2544	1368	y3622416.exe	n6589525.exe
PID 1368 wrote to memory of 2544	1368	y3622416.exe	n6589525.exe
PID 1368 wrote to memory of 2544	1368	y3622416.exe	n6589525.exe

C:\Users\Admin\AppData\Local\Temp\e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe
"C:\Users\Admin\AppData\Local\Temp\e5ef76e6dd861b064544fe5f0400d8d476e07d29a56f78d564dd2a73252e39ba.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2480

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3622416.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3622416.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1368

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0094992.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0094992.exe
3⤵
- Executes dropped EXE
PID:4616

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n6589525.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n6589525.exe
3⤵
- Executes dropped EXE
PID:2544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y3622416.exe
Filesize
271KB

MD5
d6661147ddb3234928089e58b4f2889f

SHA1
89f28713c92e4993fda09101ad2c8d32680888ea

SHA256
3c22f5aedfb3f8288d42417a253b16a1c36185882b699d73c95da7363e7eeeb9

SHA512
adea5afc00438715beaea5379a073f93a89ce83e6243aa9e820e83454b4d8455a1318e67d1d3c1d3425f1e42fcecbd10f37c64e757df9532cefead188582f864

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m0094992.exe
Filesize
141KB

MD5
788141697a3ea4c03176f64b26ffa4a1

SHA1
dfe0ddf5c274e7a90d0b1ca63320c14bfd266c2b

SHA256
567bcd83bff49aa228b9093c216643ae8d6597e17f2b5c2e022af818a184c791

SHA512
8789992e5fd419913895e62b42e6359318b00987902592cab74e50a249545ba553a4bf64041d3e12502c5e729c5dde7b0d0296cb72729247ba27713cd1bc98d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\n6589525.exe
Filesize
174KB

MD5
bf11c4a75d059bcf26fb4d2168ea375e

SHA1
85301689dbf21046939ef07575e36fc8078f3d58

SHA256
c7f310f8706c5a41f4d796803e7095a56f97fb81616416dad4ccf5fba44c8a52

SHA512
5e011bdbf4b7be8ab979063e35be2110359a48082b178de667fd066ba7ecbac1bc0fff6258b709b6807d09a55da54661eee2a2beb2fcbc62be6c06edff662ccd

Download Submit
memory/2544-17-0x000000007439E000-0x000000007439F000-memory.dmp

Filesize
4KB

Download
memory/2544-18-0x0000000000C20000-0x0000000000C50000-memory.dmp

Filesize
192KB

Download
memory/2544-19-0x0000000005500000-0x0000000005506000-memory.dmp

Filesize
24KB

Download
memory/2544-20-0x0000000005B50000-0x0000000006168000-memory.dmp

Filesize
6.1MB

Download
memory/2544-21-0x0000000005670000-0x000000000577A000-memory.dmp

Filesize
1.0MB

Download
memory/2544-22-0x00000000055B0000-0x00000000055C2000-memory.dmp

Filesize
72KB

Download
memory/2544-23-0x0000000005610000-0x000000000564C000-memory.dmp

Filesize
240KB

Download
memory/2544-24-0x0000000074390000-0x0000000074B40000-memory.dmp

Filesize
7.7MB

Download
memory/2544-25-0x0000000005780000-0x00000000057CC000-memory.dmp

Filesize
304KB

Download
memory/2544-26-0x000000007439E000-0x000000007439F000-memory.dmp

Filesize
4KB

Download
memory/2544-27-0x0000000074390000-0x0000000074B40000-memory.dmp

Filesize
7.7MB

Download