mystic | 176abc5d4c53fc1397a77e15c4028591fc335ce9464a700eddd56742d55dd10d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe
Size

1.1MB
MD5

266bb0ae217b73bd31772124f6f22efd
SHA1

cebe40031cea519b909a8444a7532abef4d28e39
SHA256

211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13
SHA512

b5cc735192135d2834a5fc909225367d8f56246f1796e1224708836aafd352a24a2f6c18a749280a86d2d0775cdd710b798cfd88038691fd6cde01648dc93bb5
SSDEEP

24576:PyXu6/RkKmvArt28Ju2ElLB859EPY4XY1vR2Ud56FUhcZavLURjx:aBGoZ26fUer15eUhcuLC

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral4/memory/1372-28-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/1372-31-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/1372-29-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral4/files/0x0007000000023420-33.dat	family_redline
behavioral4/memory/3268-35-0x0000000000140000-0x000000000017E000-memory.dmp	family_redline

Executes dropped EXE 5 IoCs

pid	Process
848	kF7QG9Ws.exe
5084	lQ5WA6Br.exe
908	FV3HP2qO.exe
1828	1mw37py4.exe
3268	2Hb570Ml.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kF7QG9Ws.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	lQ5WA6Br.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	FV3HP2qO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 1372	1828	1mw37py4.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	1828	WerFault.exe	88

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 848	4784	211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe	85
PID 4784 wrote to memory of 848	4784	211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe	85
PID 4784 wrote to memory of 848	4784	211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe	85
PID 848 wrote to memory of 5084	848	kF7QG9Ws.exe	86
PID 848 wrote to memory of 5084	848	kF7QG9Ws.exe	86
PID 848 wrote to memory of 5084	848	kF7QG9Ws.exe	86
PID 5084 wrote to memory of 908	5084	lQ5WA6Br.exe	87
PID 5084 wrote to memory of 908	5084	lQ5WA6Br.exe	87
PID 5084 wrote to memory of 908	5084	lQ5WA6Br.exe	87
PID 908 wrote to memory of 1828	908	FV3HP2qO.exe	88
PID 908 wrote to memory of 1828	908	FV3HP2qO.exe	88
PID 908 wrote to memory of 1828	908	FV3HP2qO.exe	88
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 1828 wrote to memory of 1372	1828	1mw37py4.exe	90
PID 908 wrote to memory of 3268	908	FV3HP2qO.exe	96
PID 908 wrote to memory of 3268	908	FV3HP2qO.exe	96
PID 908 wrote to memory of 3268	908	FV3HP2qO.exe	96

C:\Users\Admin\AppData\Local\Temp\211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe
"C:\Users\Admin\AppData\Local\Temp\211c4e6a11f15bd767da6f104c223571e677d598cba947fc6ecc736fb041af13.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kF7QG9Ws.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kF7QG9Ws.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lQ5WA6Br.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lQ5WA6Br.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\FV3HP2qO.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\FV3HP2qO.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mw37py4.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mw37py4.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1828
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:1372
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 600
        6⤵
        Program crash
        
        PID:872
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Hb570Ml.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Hb570Ml.exe
        5⤵
        Executes dropped EXE
        
        PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1828 -ip 1828
1⤵
PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kF7QG9Ws.exe

Filesize
950KB

MD5
7dbe0e9482df926b307b0b1124c3352d

SHA1
0b4a38082e465f06d75a7b41c2d2ccdabefa4a4f

SHA256
2604fc6b89801d0f903df401a9c692a05034b0d692a38fd5dbda3b1365952ea1

SHA512
0b961c9fc6d89a887589fd393ffe8a825a843db474f7dc57f51d7017484778485a45cf3212219c59df3508357c3e8d5bc371c25b8ec75660cb8c2553944fcc5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lQ5WA6Br.exe

Filesize
647KB

MD5
7c4c5fd169fe6ac7f28361d670ef4ff8

SHA1
0c5dcb305ba7237d3d6118994963329bddbf966f

SHA256
b1832bf0a9dae9a250b34b7540b465547964b0b04e4e14140f37b85c871f62f4

SHA512
9d19072849a3c4b827d1916a1605ca18c65e16234ba194c4a55c19a383e1af553ebf0b7a127dab591859c464d20a5c3b4b3210543f12d5e5ae6292eee80d848b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\FV3HP2qO.exe

Filesize
450KB

MD5
e40370ce84c64294d3068a86f4b1ba11

SHA1
7880c6832478097647a58e8e9d2438ab2a9c13c1

SHA256
2ad1c4ec24d69c17a3b5f3a7f41b6dfbfc22bbae50595e99c9c567f77601606b

SHA512
51a094f21bb124b96902eac651e6644e2ba3e3fb89badf4179c4ed50e221c1b2201008b7cad1934d8670d7580b606f1108de6070c0de1fb2683d8d1210c5021d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\1mw37py4.exe

Filesize
447KB

MD5
52e78ca4fc34e56b2fe84606d55aea50

SHA1
d78d1875829ac23f644cddfddd5a6cdcd296225a

SHA256
870d6301357edd2246b7be5e74dc587ef43618489429ce0f477ae7ef5a54935f

SHA512
f863763dd175a4e227d75b71bbb0253603fa9961e872c5ab3eb13defe500b00264ec4577038fb18b379c40f9d9c36864d6e8ab88947d73e26475f37609be1bb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\2Hb570Ml.exe

Filesize
221KB

MD5
00c478b4084737c66770b833561a9484

SHA1
7cceccb29438fb024ed5a48948d41acb6e80e96f

SHA256
69eceffdcf95875db9b0a812303f32fa953b932e6c03c988f3e0aa157063d1a7

SHA512
5d51549f44169c8803b31fa7cdf92722f87baca5be66db3d884afe5edba646b99dba43402ded8fe0d9fcbe6336dcd5a98a81e3abbe5d3fc6240c128bbc794809

Download Submit
memory/1372-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1372-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1372-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-35-0x0000000000140000-0x000000000017E000-memory.dmp

Filesize
248KB

Download
memory/3268-36-0x0000000007500000-0x0000000007AA4000-memory.dmp

Filesize
5.6MB

Download
memory/3268-37-0x0000000007030000-0x00000000070C2000-memory.dmp

Filesize
584KB

Download
memory/3268-38-0x00000000045E0000-0x00000000045EA000-memory.dmp

Filesize
40KB

Download
memory/3268-39-0x00000000080D0000-0x00000000086E8000-memory.dmp

Filesize
6.1MB

Download
memory/3268-40-0x0000000007390000-0x000000000749A000-memory.dmp

Filesize
1.0MB

Download
memory/3268-41-0x0000000007240000-0x0000000007252000-memory.dmp

Filesize
72KB

Download
memory/3268-42-0x00000000072A0000-0x00000000072DC000-memory.dmp

Filesize
240KB

Download
memory/3268-43-0x00000000072E0000-0x000000000732C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads