mystic | 176abc5d4c53fc1397a77e15c4028591fc335ce9464a700eddd56742d55dd10d

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe
Size

884KB
MD5

f954b567abd4771ac70491fe60ddd7a1
SHA1

86baa24fba2a84a36bae41f051ace13d396871ce
SHA256

2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110
SHA512

574d028305fabf2235d91275ecc812668e03a929eef14fe2822bfe8df7d9023e35abd5512c303a067da94cddb0b3270f681b8c80d1a18972e7d5c0fbd493cab7
SSDEEP

12288:CMr7y90OoybmDsIwO11dd+owj/W+g+mniRp4CarfhZhbquNVLpNjAOLX5fZX1S6d:Byf5Oijj/W+gS+5Zhb1Z/pfR1P

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral7/memory/2996-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/2996-22-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/2996-24-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2nz695Zx.exe	family_redline
behavioral7/memory/2460-28-0x0000000000EF0000-0x0000000000F2E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

XL3Cl0wk.exeLY2GV0eT.exe1iM71vu7.exe2nz695Zx.exe

pid process

2680 XL3Cl0wk.exe
4992 LY2GV0eT.exe
4220 1iM71vu7.exe
2460 2nz695Zx.exe

pid	process
2680	XL3Cl0wk.exe
4992	LY2GV0eT.exe
4220	1iM71vu7.exe
2460	2nz695Zx.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exeXL3Cl0wk.exeLY2GV0eT.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	XL3Cl0wk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	LY2GV0eT.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1iM71vu7.exe

description pid process target process

PID 4220 set thread context of 2996 4220 1iM71vu7.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4312 4220 WerFault.exe 1iM71vu7.exe

description	pid	process	target process
PID 4220 set thread context of 2996	4220	1iM71vu7.exe	AppLaunch.exe

pid	pid_target	process	target process
4312	4220	WerFault.exe	1iM71vu7.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exeXL3Cl0wk.exeLY2GV0eT.exe1iM71vu7.exe

description	pid	process	target process
PID 4804 wrote to memory of 2680	4804	2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe	XL3Cl0wk.exe
PID 4804 wrote to memory of 2680	4804	2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe	XL3Cl0wk.exe
PID 4804 wrote to memory of 2680	4804	2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe	XL3Cl0wk.exe
PID 2680 wrote to memory of 4992	2680	XL3Cl0wk.exe	LY2GV0eT.exe
PID 2680 wrote to memory of 4992	2680	XL3Cl0wk.exe	LY2GV0eT.exe
PID 2680 wrote to memory of 4992	2680	XL3Cl0wk.exe	LY2GV0eT.exe
PID 4992 wrote to memory of 4220	4992	LY2GV0eT.exe	1iM71vu7.exe
PID 4992 wrote to memory of 4220	4992	LY2GV0eT.exe	1iM71vu7.exe
PID 4992 wrote to memory of 4220	4992	LY2GV0eT.exe	1iM71vu7.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4220 wrote to memory of 2996	4220	1iM71vu7.exe	AppLaunch.exe
PID 4992 wrote to memory of 2460	4992	LY2GV0eT.exe	2nz695Zx.exe
PID 4992 wrote to memory of 2460	4992	LY2GV0eT.exe	2nz695Zx.exe
PID 4992 wrote to memory of 2460	4992	LY2GV0eT.exe	2nz695Zx.exe

C:\Users\Admin\AppData\Local\Temp\2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe
"C:\Users\Admin\AppData\Local\Temp\2db3eb661bd1960f4f027053512a24f0c61f26c7314d49ff0114cec48de8d110.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4804

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XL3Cl0wk.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XL3Cl0wk.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2680

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LY2GV0eT.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LY2GV0eT.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4992

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1iM71vu7.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1iM71vu7.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4220 -s 156
5⤵
- Program crash
PID:4312

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2nz695Zx.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2nz695Zx.exe
4⤵
- Executes dropped EXE
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4220 -ip 4220
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\XL3Cl0wk.exe

Filesize
590KB

MD5
c7659b675f35af31a6fa403e3fe282e3

SHA1
8d642b234350079654dcfd482f80de0aec916c00

SHA256
a3fa0c379483164299116ee0015095c95e52ef878f2d398cbceaeb7781739f0a

SHA512
4eb976207ddc4aeba263c7813af83000a773045e0665ffd9ff445e285254db749576072550bfe8f824c03a82bd1e7dc06e8711b4ea0f0ee0ec0ce6c0e7b48aea

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LY2GV0eT.exe

Filesize
417KB

MD5
865b4261b9abe9d567cda20ff888803e

SHA1
bcd506bccfc22f88ea1fda54cc7dbe537c28a212

SHA256
d04fc10ad70b654404d2431bb2694faeb538cd7c7453430a889115213bba7871

SHA512
090920a82f212fa6478ff47d96d9da0b6069fc8f91509f327beced88e57fb757c0edb58eec98097a080244b49dea981c96e39eb147eb77e8a830e4bf33192959

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1iM71vu7.exe

Filesize
378KB

MD5
f0831f173733de08511f3a0739f278a6

SHA1
06dc809d653c5d2c97386084ae13b50a73eb5b60

SHA256
8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

SHA512
19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2nz695Zx.exe

Filesize
231KB

MD5
c87f923ceab584f07d1d69c52eafdb3b

SHA1
46e62343af153381e8eab0e233fb3a11fbe7ce11

SHA256
7f0478f211b33d78dc925d81f1a80ead5d7fbf7d96f29ab357ea6f2559b7f0d1

SHA512
f9dc49cc67c92e40b52bcc9e72a28ab33955206b0242a5c0d38122d9332341e499dfb6a6a3f9af7f9eb1be6ea80ef0ad12f4c8ee922e63b1a3e9c88fc5e787b0

Download Submit
memory/2460-33-0x0000000007F80000-0x000000000808A000-memory.dmp

Filesize
1.0MB

Download
memory/2460-28-0x0000000000EF0000-0x0000000000F2E000-memory.dmp

Filesize
248KB

Download
memory/2460-29-0x0000000008160000-0x0000000008704000-memory.dmp

Filesize
5.6MB

Download
memory/2460-30-0x0000000007C70000-0x0000000007D02000-memory.dmp

Filesize
584KB

Download
memory/2460-31-0x0000000003220000-0x000000000322A000-memory.dmp

Filesize
40KB

Download
memory/2460-32-0x0000000008D30000-0x0000000009348000-memory.dmp

Filesize
6.1MB

Download
memory/2460-34-0x0000000007EB0000-0x0000000007EC2000-memory.dmp

Filesize
72KB

Download
memory/2460-35-0x0000000007F10000-0x0000000007F4C000-memory.dmp

Filesize
240KB

Download
memory/2460-36-0x0000000008090000-0x00000000080DC000-memory.dmp

Filesize
304KB

Download
memory/2996-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-22-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download