mystic | 8ee265740e734e664a806025412118c1398e5fd5de8de7844c913c144f497faa

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe
Size

884KB
MD5

9bd46d04ccf0e58049a11dd8b0e252e3
SHA1

1700b577b164ed8ae5f4c91797eff3a164cd4600
SHA256

75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2
SHA512

a2cb32897e38fb1ac0df517293ebf4e5cfa3ccdd09a3ba19a04813c1b522553befd2e24009463dd22b6aefe76e17d10b7eda4b3fc9d1d946c584660da32b8a1d
SSDEEP

24576:kyy9dSb2i36Gg8cW1B3wGWh2NkhWPKMwDIA7LqtR:zyfS/qGg8c+wGvoWiMwVyt

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral7/memory/2976-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/2976-22-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/2976-24-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral7/files/0x000700000002345f-26.dat	family_redline
behavioral7/memory/3388-28-0x00000000002B0000-0x00000000002EE000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
3316	dV0xw3lR.exe
4464	QR9Qg3JP.exe
2992	1Bu32UY3.exe
3388	2Rx549Ez.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	QR9Qg3JP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	dV0xw3lR.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2976	2992	1Bu32UY3.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4752	2992	WerFault.exe	85

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 224 wrote to memory of 3316	224	75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe	83
PID 224 wrote to memory of 3316	224	75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe	83
PID 224 wrote to memory of 3316	224	75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe	83
PID 3316 wrote to memory of 4464	3316	dV0xw3lR.exe	84
PID 3316 wrote to memory of 4464	3316	dV0xw3lR.exe	84
PID 3316 wrote to memory of 4464	3316	dV0xw3lR.exe	84
PID 4464 wrote to memory of 2992	4464	QR9Qg3JP.exe	85
PID 4464 wrote to memory of 2992	4464	QR9Qg3JP.exe	85
PID 4464 wrote to memory of 2992	4464	QR9Qg3JP.exe	85
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 2992 wrote to memory of 2976	2992	1Bu32UY3.exe	87
PID 4464 wrote to memory of 3388	4464	QR9Qg3JP.exe	94
PID 4464 wrote to memory of 3388	4464	QR9Qg3JP.exe	94
PID 4464 wrote to memory of 3388	4464	QR9Qg3JP.exe	94

C:\Users\Admin\AppData\Local\Temp\75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe
"C:\Users\Admin\AppData\Local\Temp\75a099d51b4f58a6df537c770b8d75820445fa7798e533b8d2312b46e4d407a2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:224
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dV0xw3lR.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dV0xw3lR.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QR9Qg3JP.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QR9Qg3JP.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Bu32UY3.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Bu32UY3.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:2992
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2976
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 600
        5⤵
        Program crash
        
        PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Rx549Ez.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Rx549Ez.exe
      4⤵
      Executes dropped EXE
      PID:3388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2992 -ip 2992
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dV0xw3lR.exe

Filesize
590KB

MD5
30b57d9b49d590306ba4910126119e40

SHA1
2869a6c2cdff2a1de1f024d7906be21e5e7aa3a9

SHA256
b4f2e99a8312ad83c562b6698383b98038db44845322488339ea50b910a50466

SHA512
7a0d0c486776767a3d0038791c1c0652d153da2a88277e692cf97a54b667c386f46e16b6b6ffa606104f4a051221197eecb01894682d7b5640a3f894d84e71b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\QR9Qg3JP.exe

Filesize
417KB

MD5
bc8014cfcc3ef8d61d1b10ae90e6d631

SHA1
62ea82f37db9b4d526a77f609c82b2885c2b57ef

SHA256
046aee0fbac621cc007a7ddff85e8f05dfb6a734ac0d42a05ff7ced536de499e

SHA512
07a440b233fb47ca57c5c25663957391bff0e2fcb21596bc2c10b59b6e82aa346a719fb61024c5a22d0bb443f3ebee783bc82a792e3234a7cc1e7d8d9e66192c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Bu32UY3.exe

Filesize
378KB

MD5
e91f8c3319bdb0201e7cb3c5cee4a347

SHA1
cccd25168272efb28fb793fc94fd614917a40ef7

SHA256
c83e6adbe97ad7c4bbd43640fcc10e93465da7cf01515b6dfadf41aceb33c14c

SHA512
3fcbd6cc23fef68d295010369c403350e062b76ba46566d844c1013a997510578b17dbca5a4ad7f8c1bd8037885fdbd3274126d1dc3013b4b82d6f5f0fd82e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Rx549Ez.exe

Filesize
231KB

MD5
d15466babc5bd09332b0350edc0f872e

SHA1
b77e5157c9efc66cb7a87f068dd5ccf3ff7b54f8

SHA256
b85735f798257506cd3ec3d402e393e25620a09f0f7c3e922aef107c155d8f55

SHA512
1e0018e352f6bac9ccf5f163b8d0ea03a3c71a51cbe737d66396d82c43297401fc64ffff498eb704c20e2f4f7d3d24ffaf9971ae35defc559e6516277b4c7ef9

Download Submit
memory/2976-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-22-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2976-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3388-29-0x0000000007690000-0x0000000007C34000-memory.dmp

Filesize
5.6MB

Download
memory/3388-28-0x00000000002B0000-0x00000000002EE000-memory.dmp

Filesize
248KB

Download
memory/3388-30-0x00000000071C0000-0x0000000007252000-memory.dmp

Filesize
584KB

Download
memory/3388-31-0x00000000026F0000-0x00000000026FA000-memory.dmp

Filesize
40KB

Download
memory/3388-32-0x0000000008260000-0x0000000008878000-memory.dmp

Filesize
6.1MB

Download
memory/3388-33-0x00000000074C0000-0x00000000075CA000-memory.dmp

Filesize
1.0MB

Download
memory/3388-34-0x00000000073D0000-0x00000000073E2000-memory.dmp

Filesize
72KB

Download
memory/3388-35-0x0000000007430000-0x000000000746C000-memory.dmp

Filesize
240KB

Download
memory/3388-36-0x0000000007470000-0x00000000074BC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads