mystic | c35b2a353f3f737fd5d522bda8150c7fe11a4c4773ad1702d174b480462784c6

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe
Size

1.2MB
MD5

34bd88866a21f46e8aac88ce27ece869
SHA1

9c55dc3e1bd014ca0b856b6ab8639b5a8bffeb3b
SHA256

5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58
SHA512

b6089180dfc0936be3e17868ef1d815d1cc5d6f8f346a1840649d8c4ec3d21a3a4a073f49ba444cf5a5211caf87a510f1221576799fe2ffa3a22e1d19d251e5f
SSDEEP

24576:9ybWjicQBao2bo3GEq+0mABw8DuA1m+2NysFED8pvxtvs6x81lqa9kb3:YWicQBP2M3Ga0xBFCA4iW/v/61lH9k

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral5/memory/4816-35-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral5/memory/4816-38-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral5/memory/4816-37-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral5/files/0x0007000000023426-40.dat	family_redline
behavioral5/memory/4800-42-0x0000000000C70000-0x0000000000CAE000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
2888	Jy9vG4vV.exe
4776	XM1sC3iy.exe
2580	yB3qe9oe.exe
3620	gI3fo3mF.exe
2868	1PY13Ks8.exe
4800	2Lw469gT.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Jy9vG4vV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	XM1sC3iy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	yB3qe9oe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	gI3fo3mF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 4816	2868	1PY13Ks8.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4324	2868	WerFault.exe	87

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2888	3416	5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe	82
PID 3416 wrote to memory of 2888	3416	5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe	82
PID 3416 wrote to memory of 2888	3416	5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe	82
PID 2888 wrote to memory of 4776	2888	Jy9vG4vV.exe	83
PID 2888 wrote to memory of 4776	2888	Jy9vG4vV.exe	83
PID 2888 wrote to memory of 4776	2888	Jy9vG4vV.exe	83
PID 4776 wrote to memory of 2580	4776	XM1sC3iy.exe	84
PID 4776 wrote to memory of 2580	4776	XM1sC3iy.exe	84
PID 4776 wrote to memory of 2580	4776	XM1sC3iy.exe	84
PID 2580 wrote to memory of 3620	2580	yB3qe9oe.exe	86
PID 2580 wrote to memory of 3620	2580	yB3qe9oe.exe	86
PID 2580 wrote to memory of 3620	2580	yB3qe9oe.exe	86
PID 3620 wrote to memory of 2868	3620	gI3fo3mF.exe	87
PID 3620 wrote to memory of 2868	3620	gI3fo3mF.exe	87
PID 3620 wrote to memory of 2868	3620	gI3fo3mF.exe	87
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 2868 wrote to memory of 4816	2868	1PY13Ks8.exe	90
PID 3620 wrote to memory of 4800	3620	gI3fo3mF.exe	95
PID 3620 wrote to memory of 4800	3620	gI3fo3mF.exe	95
PID 3620 wrote to memory of 4800	3620	gI3fo3mF.exe	95

C:\Users\Admin\AppData\Local\Temp\5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe
"C:\Users\Admin\AppData\Local\Temp\5c5167b5fa76db29ca8ae12f128646effd9bcc1c8956371aaee13bddc98fbe58.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jy9vG4vV.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jy9vG4vV.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XM1sC3iy.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XM1sC3iy.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB3qe9oe.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB3qe9oe.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\gI3fo3mF.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\gI3fo3mF.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1PY13Ks8.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1PY13Ks8.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 152
        7⤵
        Program crash
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Lw469gT.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Lw469gT.exe
        6⤵
        Executes dropped EXE
        
        PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2868 -ip 2868
1⤵
PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Jy9vG4vV.exe

Filesize
1.0MB

MD5
92bcae9523fa276ff5cbec7700876fe5

SHA1
308a273b3e213e1d1f77d4e8ba4c586bf6054ba8

SHA256
cc1aa43c0328e4b58f784be077e6b72d9deb9079c2858217338704d5e952cb7c

SHA512
f2bbb48ad972572b83a00e421714e6e0e69e24eca3f5a94996a7b06d78361c4a78e2db3411cc35c50f0994f2c5af7384a15e547d9bf012c4ea57e43275448c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XM1sC3iy.exe

Filesize
884KB

MD5
ea0ac474ffd1b5126c78f897ebf94d9d

SHA1
8abdd1a8911c3c4093490afd7ed89527b7670ed6

SHA256
f5d2169a9ecc93fd57c081e3b609dce0d546f026584245c9b519c5c06ad0fa79

SHA512
17b5a3fc6f6f87cc4f44899e902f5ecabf252c3834ba52ce718b36bf7036e096e8945a876b1c3809f1a9bc495a6a1e8e12a4edd4153d30344dc8ba200dd6d23d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\yB3qe9oe.exe

Filesize
590KB

MD5
17690c1b10bae3f34acae87975eba51e

SHA1
f9c9cc016eb1158101fda934ad1f77f788714a8e

SHA256
155aa6b44d63f75e82d3c8ed71c473dcc489f72f1ea888934193d6d3eeb0f7db

SHA512
21585c47ffdea3750afd0d6d488036a56b72da78703e9d4dc1d1246ce67de8004c341a0f0862386a9faf8664f2add457f32c4536c3fee0ecfb64b567b03bcd4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\gI3fo3mF.exe

Filesize
417KB

MD5
459be124daa7b2cee946a6e817bc4aca

SHA1
0a7cc81eb16d44bd4f95de294eda2fde57e66c2b

SHA256
0d68190bc3532fb0efb7df9df9e3036bd6abfc1d2fdb1e20cae06941abc67abf

SHA512
44e5770efcfb1c399b9c6777c28a2419f07b3b6199f73f1eacb0abc7baf8fe6618124b291dfa8428deb8ec3de1d65b52b613e4ae88d9a58710e6d0e6ac7dee3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1PY13Ks8.exe

Filesize
378KB

MD5
f0831f173733de08511f3a0739f278a6

SHA1
06dc809d653c5d2c97386084ae13b50a73eb5b60

SHA256
8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

SHA512
19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2Lw469gT.exe

Filesize
231KB

MD5
0258dbe115a62667aa8a06ad3d8fd735

SHA1
98b2234856ef0a8adc212f03c67a7efbd77e5c96

SHA256
6af2a1fafa879b054235181766ea8a987b56bff4873438da5e380dfcd11579d3

SHA512
b88f519b92c80f51447e08f33ee1ca1cd3f8316ff85a9c301542d7ef79bc5b80ea41c47b2892c69796320a3702b6d88fce123cc88656ae96e9c3d90fa3fc6324

Download Submit
memory/4800-42-0x0000000000C70000-0x0000000000CAE000-memory.dmp

Filesize
248KB

Download
memory/4800-43-0x0000000008090000-0x0000000008634000-memory.dmp

Filesize
5.6MB

Download
memory/4800-44-0x0000000007B80000-0x0000000007C12000-memory.dmp

Filesize
584KB

Download
memory/4800-45-0x0000000002F70000-0x0000000002F7A000-memory.dmp

Filesize
40KB

Download
memory/4800-46-0x0000000008C60000-0x0000000009278000-memory.dmp

Filesize
6.1MB

Download
memory/4800-47-0x0000000007EF0000-0x0000000007FFA000-memory.dmp

Filesize
1.0MB

Download
memory/4800-48-0x0000000007C70000-0x0000000007C82000-memory.dmp

Filesize
72KB

Download
memory/4800-49-0x0000000007DE0000-0x0000000007E1C000-memory.dmp

Filesize
240KB

Download
memory/4800-50-0x0000000007E20000-0x0000000007E6C000-memory.dmp

Filesize
304KB

Download
memory/4816-38-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4816-37-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4816-35-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads