mystic | 176abc5d4c53fc1397a77e15c4028591fc335ce9464a700eddd56742d55dd10d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe
Size

1.2MB
MD5

2fbb7ec96e3f72fa4114d9106e9169e6
SHA1

c3235479063bea76bcc981179d53b6c1194e9c55
SHA256

1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb
SHA512

751a6ec4be6814efa1bd7788407560480e3ec2193a6012b51089f9cd67a93923c648a82c03b833a7ea173b681f052c4631733cbc1bdbad9591a80609b54712af
SSDEEP

24576:HyeejGI189ls1fFRnxfDjr/CHy1CgsJr0ffRIz3v5MXBSDbcaprG:SekGI189ls1fvFr/CS1C3r0ffRIdMRSt

Score

10^/10

mystic redline lutyr infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1236-38-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral3/memory/1236-36-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral3/memory/1236-35-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2rh336DU.exe	family_redline
behavioral3/memory/3908-42-0x00000000006D0000-0x000000000070E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

nu2ti5tl.exeLv0RG8vv.exeXw8HQ2vM.exelY9mL0gk.exe1NO74PL7.exe2rh336DU.exe

pid process

2380 nu2ti5tl.exe
948 Lv0RG8vv.exe
3860 Xw8HQ2vM.exe
3684 lY9mL0gk.exe
824 1NO74PL7.exe
3908 2rh336DU.exe

pid	process
2380	nu2ti5tl.exe
948	Lv0RG8vv.exe
3860	Xw8HQ2vM.exe
3684	lY9mL0gk.exe
824	1NO74PL7.exe
3908	2rh336DU.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exenu2ti5tl.exeLv0RG8vv.exeXw8HQ2vM.exelY9mL0gk.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	nu2ti5tl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Lv0RG8vv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Xw8HQ2vM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	lY9mL0gk.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1NO74PL7.exe

description pid process target process

PID 824 set thread context of 1236 824 1NO74PL7.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2432 824 WerFault.exe 1NO74PL7.exe

description	pid	process	target process
PID 824 set thread context of 1236	824	1NO74PL7.exe	AppLaunch.exe

pid	pid_target	process	target process
2432	824	WerFault.exe	1NO74PL7.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exenu2ti5tl.exeLv0RG8vv.exeXw8HQ2vM.exelY9mL0gk.exe1NO74PL7.exe

description	pid	process	target process
PID 2452 wrote to memory of 2380	2452	1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe	nu2ti5tl.exe
PID 2452 wrote to memory of 2380	2452	1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe	nu2ti5tl.exe
PID 2452 wrote to memory of 2380	2452	1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe	nu2ti5tl.exe
PID 2380 wrote to memory of 948	2380	nu2ti5tl.exe	Lv0RG8vv.exe
PID 2380 wrote to memory of 948	2380	nu2ti5tl.exe	Lv0RG8vv.exe
PID 2380 wrote to memory of 948	2380	nu2ti5tl.exe	Lv0RG8vv.exe
PID 948 wrote to memory of 3860	948	Lv0RG8vv.exe	Xw8HQ2vM.exe
PID 948 wrote to memory of 3860	948	Lv0RG8vv.exe	Xw8HQ2vM.exe
PID 948 wrote to memory of 3860	948	Lv0RG8vv.exe	Xw8HQ2vM.exe
PID 3860 wrote to memory of 3684	3860	Xw8HQ2vM.exe	lY9mL0gk.exe
PID 3860 wrote to memory of 3684	3860	Xw8HQ2vM.exe	lY9mL0gk.exe
PID 3860 wrote to memory of 3684	3860	Xw8HQ2vM.exe	lY9mL0gk.exe
PID 3684 wrote to memory of 824	3684	lY9mL0gk.exe	1NO74PL7.exe
PID 3684 wrote to memory of 824	3684	lY9mL0gk.exe	1NO74PL7.exe
PID 3684 wrote to memory of 824	3684	lY9mL0gk.exe	1NO74PL7.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 824 wrote to memory of 1236	824	1NO74PL7.exe	AppLaunch.exe
PID 3684 wrote to memory of 3908	3684	lY9mL0gk.exe	2rh336DU.exe
PID 3684 wrote to memory of 3908	3684	lY9mL0gk.exe	2rh336DU.exe
PID 3684 wrote to memory of 3908	3684	lY9mL0gk.exe	2rh336DU.exe

C:\Users\Admin\AppData\Local\Temp\1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe
"C:\Users\Admin\AppData\Local\Temp\1ded3ef8a66199255bccbc48246fb511b05dd362acee6fc379d36afee68aa1eb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2452

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nu2ti5tl.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nu2ti5tl.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2380

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv0RG8vv.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv0RG8vv.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:948

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Xw8HQ2vM.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Xw8HQ2vM.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3860

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lY9mL0gk.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lY9mL0gk.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3684

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1NO74PL7.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1NO74PL7.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:1236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 140
7⤵
- Program crash
PID:2432

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2rh336DU.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2rh336DU.exe
6⤵
- Executes dropped EXE
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 824 -ip 824
1⤵
PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\nu2ti5tl.exe

Filesize
1.0MB

MD5
b978f69b15b5c16bba212af97f5635ec

SHA1
658e16a81d6809b230335a8323eb8d395be71de6

SHA256
196247a4d834971d318ac71db8bf60af60430d664b34085147046f6774c80677

SHA512
1a1abd6b05db825a12e4b5644b7574d8f1c7f000eebb4dcb9b9fa8254fe3a33bb1128ccc7297a8d9b40b083d372e1e703141bc16fcf1e665f11eaefe552c3bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Lv0RG8vv.exe

Filesize
879KB

MD5
bb845a15dee0ce72c5ec078d787e575e

SHA1
34dac2c18762806063ac9a6da35f8c01c3d2dbd2

SHA256
30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8

SHA512
1b5ea031e494e67d5dbb811c5c0eba5c2994088a7837058a3e3017adb72ffdb8b98d947900fd5abd3466e22304d08d7bb32d55e1c2284f35c188eedd0c4e2474

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Xw8HQ2vM.exe

Filesize
585KB

MD5
2ee5e4a00806d834c5f66cc530079529

SHA1
ef959a2656737768e0344ea30d6b2f0b4e1492f8

SHA256
9c6c3019f56bbeb336c6582f9eb50a13119c66d78466f98e3613e1f2e7395b7d

SHA512
7c9f4d1669e1a7538d54fa6ca60d47581676777dc58a75dd77ca4509088cbd33d930a4913bf2b4e4055f861181ce4eb0ab231e3729b00774b80b9c750ab20899

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\lY9mL0gk.exe

Filesize
413KB

MD5
6c4864b47b3d321384bee56a44edfd85

SHA1
eadc96a9982040175ae6eaa87efa2f35b7b15a34

SHA256
84f029ee6ccd55e1daa08d834e7e7cbc6862d6bac59906a60911cb3876efe42a

SHA512
1ef3ea4225b2e9f781d1ec2ce6e7914ba996b757f464c57b52928e0c521eb8ae9b8995e748ff2e1749ab92752d8a1c1d813a78f8bcd7a850fe0b100a3194a595

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1NO74PL7.exe

Filesize
378KB

MD5
42f66f3976aa5c14fe644bbdb3ebf7f4

SHA1
f6d3a99d45c13559f8d478234d3bfb14c2278ab1

SHA256
ff2561f6df847478ce0a417b13853418ac63456bc61a1e4399ab8074fdd2062b

SHA512
e6624701d6c93ca6c8554bf5e478d00162318415293c34bcaef0715e5c285c7235fb49c9c9f6732e1909f908a1a0a1ca2cb2950b1fdb2f26b9919884fb2eec90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2rh336DU.exe

Filesize
221KB

MD5
0288648a07286c7f015a4532f9399a48

SHA1
0088bd95d23807b6ebd5cee00cd303ea1ad06ad1

SHA256
68388a86d9ee9d7cb5f16c84f5c8910774f55ed93ae07e80e4fe1080e6ddaee6

SHA512
6c1254faad1ffaacc7020a28b4a863d9560432af18b7e63a2aad08204f1595ab518a2502b0499b23cfce4e98f56a47d910e89171deb498986392deec39dad2fb

Download Submit
memory/1236-36-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-35-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-38-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3908-42-0x00000000006D0000-0x000000000070E000-memory.dmp

Filesize
248KB

Download
memory/3908-43-0x0000000007B10000-0x00000000080B4000-memory.dmp

Filesize
5.6MB

Download
memory/3908-44-0x0000000007600000-0x0000000007692000-memory.dmp

Filesize
584KB

Download
memory/3908-45-0x00000000077A0000-0x00000000077AA000-memory.dmp

Filesize
40KB

Download
memory/3908-46-0x00000000086E0000-0x0000000008CF8000-memory.dmp

Filesize
6.1MB

Download
memory/3908-48-0x0000000007870000-0x0000000007882000-memory.dmp

Filesize
72KB

Download
memory/3908-49-0x00000000078D0000-0x000000000790C000-memory.dmp

Filesize
240KB

Download
memory/3908-47-0x0000000007940000-0x0000000007A4A000-memory.dmp

Filesize
1.0MB

Download
memory/3908-50-0x0000000007A50000-0x0000000007A9C000-memory.dmp

Filesize
304KB

Download