mystic | c35b2a353f3f737fd5d522bda8150c7fe11a4c4773ad1702d174b480462784c6

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe
Size

884KB
MD5

9da6ae0abd9c3a78664394854d47e298
SHA1

9e0aa5c1f54a56f31406ad10558fb9cb921dbcf6
SHA256

df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851
SHA512

16e466a37d1b953bad31d04164a6ab3622cd29b2e2ec27a522bcf688aa706eda232a4952e1bcb328c4fc52ef089a7ec2b91663baa45e9d4253800e620658086c
SSDEEP

24576:byRu5r0YROgynnLwA5fIjaKPNQ3fF2VsIY4:OI5Q24nnEPpPcN2VS

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral21/memory/2972-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral21/memory/2972-22-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral21/memory/2972-24-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BX575tZ.exe	family_redline
behavioral21/memory/5076-28-0x0000000000930000-0x000000000096E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

Qt7dD0Pg.exeZU5uJ9kP.exe1xn44zi1.exe2BX575tZ.exe

pid process

632 Qt7dD0Pg.exe
1716 ZU5uJ9kP.exe
1020 1xn44zi1.exe
5076 2BX575tZ.exe

pid	process
632	Qt7dD0Pg.exe
1716	ZU5uJ9kP.exe
1020	1xn44zi1.exe
5076	2BX575tZ.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ZU5uJ9kP.exedf0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exeQt7dD0Pg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ZU5uJ9kP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Qt7dD0Pg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1xn44zi1.exe

description pid process target process

PID 1020 set thread context of 2972 1020 1xn44zi1.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4864 1020 WerFault.exe 1xn44zi1.exe

description	pid	process	target process
PID 1020 set thread context of 2972	1020	1xn44zi1.exe	AppLaunch.exe

pid	pid_target	process	target process
4864	1020	WerFault.exe	1xn44zi1.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exeQt7dD0Pg.exeZU5uJ9kP.exe1xn44zi1.exe

description	pid	process	target process
PID 3484 wrote to memory of 632	3484	df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe	Qt7dD0Pg.exe
PID 3484 wrote to memory of 632	3484	df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe	Qt7dD0Pg.exe
PID 3484 wrote to memory of 632	3484	df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe	Qt7dD0Pg.exe
PID 632 wrote to memory of 1716	632	Qt7dD0Pg.exe	ZU5uJ9kP.exe
PID 632 wrote to memory of 1716	632	Qt7dD0Pg.exe	ZU5uJ9kP.exe
PID 632 wrote to memory of 1716	632	Qt7dD0Pg.exe	ZU5uJ9kP.exe
PID 1716 wrote to memory of 1020	1716	ZU5uJ9kP.exe	1xn44zi1.exe
PID 1716 wrote to memory of 1020	1716	ZU5uJ9kP.exe	1xn44zi1.exe
PID 1716 wrote to memory of 1020	1716	ZU5uJ9kP.exe	1xn44zi1.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1020 wrote to memory of 2972	1020	1xn44zi1.exe	AppLaunch.exe
PID 1716 wrote to memory of 5076	1716	ZU5uJ9kP.exe	2BX575tZ.exe
PID 1716 wrote to memory of 5076	1716	ZU5uJ9kP.exe	2BX575tZ.exe
PID 1716 wrote to memory of 5076	1716	ZU5uJ9kP.exe	2BX575tZ.exe

C:\Users\Admin\AppData\Local\Temp\df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe
"C:\Users\Admin\AppData\Local\Temp\df0b96135e1607d766af3caf4942e58032580d533155a67061447124b2259851.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3484

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qt7dD0Pg.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qt7dD0Pg.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:632

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZU5uJ9kP.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZU5uJ9kP.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1716

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1xn44zi1.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1xn44zi1.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:2972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 156
5⤵
- Program crash
PID:4864

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BX575tZ.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BX575tZ.exe
4⤵
- Executes dropped EXE
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1020 -ip 1020
1⤵
PID:2952

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Qt7dD0Pg.exe
Filesize
590KB

MD5
bd133290f511920f298fa06434c1c287

SHA1
1d5a00df6147f618b362538ef301dbf000cb0ea7

SHA256
4f229b91f096ddcd089e53b2bbc4199081927215b543cb56a8e3418f67f76cf6

SHA512
c9ff3d6e3c57a2f5f3bfd990f4e3fc18dcbc4e57f42b298597155f65ba3e735be17afc3e9bf3016f1fc139ad65dabf4f54bdc60b274616dd8316b4aa5b91b9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZU5uJ9kP.exe
Filesize
417KB

MD5
0cc39ad4dd1a82de2e928b7d0295f632

SHA1
2ce0398f691d33e53dbf3e03ffc291fa5a462bde

SHA256
fbdad2517886a3b3a5b5bda2bc6c327a40c9ec47ddd2502798671b0402628d7b

SHA512
1c7b61e59192b5b501c8355da05cc215c6050ae587678a736be3d544680eba6039f695f7ea2a66bb1584a36a6352f85b18b35d7d7e492eabcb13a184f84e2e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1xn44zi1.exe
Filesize
378KB

MD5
e01683ed0d844f32b7f0bbc0ceb02946

SHA1
f7479ca96eefbe198140695138ba7f2b700e66ab

SHA256
992c361d7665d278fb0872ee593f224d2b24bccfbb6d095f4e85fd5ccc7797fd

SHA512
5378b695ece9df979889eaa8ebd43f9289cb2574a5f2c011cc2471341e297055e9d48f71b01bb5a16028b572ad930e2628a6ad10b6e7ccb12ae86aa69388beb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BX575tZ.exe
Filesize
231KB

MD5
981ab2d61474d066313b787214f973dd

SHA1
f1f73ae8f4aea80693f9362fadf33c569e60d085

SHA256
d06f5d87ef516f9e3e89717df09d99acf7f445ddfcb6394b9d3c40dff40515b0

SHA512
46adf9425d653264c1ef2b6dd050052d9a60f72d84f8405f5bbbe0b235624c766cfc6ccda4687b7f4c2cbd6b7b3bc1519c02942f7e2cf2408986c6e36c6c43c4

Download Submit
memory/2972-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2972-22-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2972-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5076-29-0x0000000007BE0000-0x0000000008184000-memory.dmp

Filesize
5.6MB

Download
memory/5076-28-0x0000000000930000-0x000000000096E000-memory.dmp

Filesize
248KB

Download
memory/5076-30-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/5076-31-0x0000000004C90000-0x0000000004C9A000-memory.dmp

Filesize
40KB

Download
memory/5076-32-0x00000000087B0000-0x0000000008DC8000-memory.dmp

Filesize
6.1MB

Download
memory/5076-33-0x0000000007AC0000-0x0000000007BCA000-memory.dmp

Filesize
1.0MB

Download
memory/5076-34-0x00000000078E0000-0x00000000078F2000-memory.dmp

Filesize
72KB

Download
memory/5076-35-0x0000000007940000-0x000000000797C000-memory.dmp

Filesize
240KB

Download
memory/5076-36-0x00000000079B0000-0x00000000079FC000-memory.dmp

Filesize
304KB

Download