mystic | 176abc5d4c53fc1397a77e15c4028591fc335ce9464a700eddd56742d55dd10d

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe
Size

585KB
MD5

eb8c6a30c565e85b4f99969ed75caaf7
SHA1

a54a173fa9b32936b276a8f097b6282dd5fdaae3
SHA256

38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504
SHA512

42da14144ff1deadbae8d17d8388ddc44aa35e2a1d290fb8d300bc4d20233d316d4694e0e368c1ec08a89dd47290fd709d6928db0e1c7a4a06fb9ddd4ed14101
SSDEEP

12288:9MrNy90FTcFVVcz437oRAjVFIucRC8zhOQwl0Dyy:Iym4Vcm7oRAjHERC8tFwliyy

Score

10^/10

mystic redline lutyr infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral8/memory/4312-14-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/4312-15-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/4312-18-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/4312-16-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2tx878LD.exe	family_redline
behavioral8/memory/2152-22-0x0000000000210000-0x000000000024E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

vW9MP3wk.exe1Gh83TD8.exe2tx878LD.exe

pid process

3000 vW9MP3wk.exe
1924 1Gh83TD8.exe
2152 2tx878LD.exe

pid	process
3000	vW9MP3wk.exe
1924	1Gh83TD8.exe
2152	2tx878LD.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

vW9MP3wk.exe38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	vW9MP3wk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1Gh83TD8.exe

description pid process target process

PID 1924 set thread context of 4312 1924 1Gh83TD8.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

556 1924 WerFault.exe 1Gh83TD8.exe
4120 4312 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 1924 set thread context of 4312	1924	1Gh83TD8.exe	AppLaunch.exe

pid	pid_target	process	target process
556	1924	WerFault.exe	1Gh83TD8.exe
4120	4312	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exevW9MP3wk.exe1Gh83TD8.exe

description	pid	process	target process
PID 1372 wrote to memory of 3000	1372	38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe	vW9MP3wk.exe
PID 1372 wrote to memory of 3000	1372	38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe	vW9MP3wk.exe
PID 1372 wrote to memory of 3000	1372	38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe	vW9MP3wk.exe
PID 3000 wrote to memory of 1924	3000	vW9MP3wk.exe	1Gh83TD8.exe
PID 3000 wrote to memory of 1924	3000	vW9MP3wk.exe	1Gh83TD8.exe
PID 3000 wrote to memory of 1924	3000	vW9MP3wk.exe	1Gh83TD8.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 1924 wrote to memory of 4312	1924	1Gh83TD8.exe	AppLaunch.exe
PID 3000 wrote to memory of 2152	3000	vW9MP3wk.exe	2tx878LD.exe
PID 3000 wrote to memory of 2152	3000	vW9MP3wk.exe	2tx878LD.exe
PID 3000 wrote to memory of 2152	3000	vW9MP3wk.exe	2tx878LD.exe

C:\Users\Admin\AppData\Local\Temp\38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe
"C:\Users\Admin\AppData\Local\Temp\38f672e7cba986b4d9af3c51220a9df7a2a858c8744e2594475ff11d2cd80504.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1372

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vW9MP3wk.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vW9MP3wk.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3000

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Gh83TD8.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Gh83TD8.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 540
5⤵
- Program crash
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 600
4⤵
- Program crash
PID:556

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2tx878LD.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2tx878LD.exe
3⤵
- Executes dropped EXE
PID:2152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4312 -ip 4312
1⤵
PID:1480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1924 -ip 1924
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vW9MP3wk.exe

Filesize
413KB

MD5
b163d6ffba3751751a5570cccb4a068c

SHA1
7c1c2a9f538f84bf2ebbadcdc883596e8132f0fa

SHA256
460a2b5e89109f4b099eff21508b5057e37c0f51eb63ff775a888ddff7bdfb70

SHA512
435c5fb680421b5678db467536e1c36a0b388359ed8799dec0374d6e0d33b0833573caf9419583b719f06eb16a3152e0e4fbc02457037729f0826e50d8a75527

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Gh83TD8.exe

Filesize
378KB

MD5
624dff92424f1705c663a48f0b9dc03a

SHA1
f6e718d44636592d640239f99493b68385d3587f

SHA256
6b200080b08d28ac73676817e8c826c84ae13e3a8436129be08d958c1ebdabea

SHA512
284c040a77d788fc5630fcfff91c3484de3ac684b3d65c6893fb652a4b4f6b2af9ebb3098158dafcfdeef8f31897284d86385eb1414ca560ed28d022bc6b2425

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2tx878LD.exe

Filesize
221KB

MD5
18f38037f957357ba2645a1b756548a0

SHA1
806f2c9e0014da16b3eed6862deb83e2204acd74

SHA256
a6072c306a8aca50dec1403fd47d7e0faf958060105b4126eb9918fb35518b01

SHA512
9975c9cadb7e1515c00cf52c8a29edb429f12f5ccecb388a05501856e61f8ae51d86f37b78d3c582cb6a5e6173801ff4373286aa31235f42512b5283c6549430

Download Submit
memory/2152-27-0x0000000007360000-0x000000000746A000-memory.dmp

Filesize
1.0MB

Download
memory/2152-22-0x0000000000210000-0x000000000024E000-memory.dmp

Filesize
248KB

Download
memory/2152-23-0x0000000007510000-0x0000000007AB4000-memory.dmp

Filesize
5.6MB

Download
memory/2152-24-0x0000000007000000-0x0000000007092000-memory.dmp

Filesize
584KB

Download
memory/2152-25-0x0000000002540000-0x000000000254A000-memory.dmp

Filesize
40KB

Download
memory/2152-26-0x00000000080E0000-0x00000000086F8000-memory.dmp

Filesize
6.1MB

Download
memory/2152-28-0x00000000070D0000-0x00000000070E2000-memory.dmp

Filesize
72KB

Download
memory/2152-29-0x0000000007250000-0x000000000728C000-memory.dmp

Filesize
240KB

Download
memory/2152-30-0x0000000007100000-0x000000000714C000-memory.dmp

Filesize
304KB

Download
memory/4312-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4312-16-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4312-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4312-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download