mystic | 3c91163ea40ad7e35bac48ded16235cfe9003c914f570e27b4e2d7b3c9c46c05

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe
Size

879KB
MD5

bb845a15dee0ce72c5ec078d787e575e
SHA1

34dac2c18762806063ac9a6da35f8c01c3d2dbd2
SHA256

30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8
SHA512

1b5ea031e494e67d5dbb811c5c0eba5c2994088a7837058a3e3017adb72ffdb8b98d947900fd5abd3466e22304d08d7bb32d55e1c2284f35c188eedd0c4e2474
SSDEEP

24576:RytpC1GzopxzgjCQIWyraHbJPKd6NIT3R5Pi+OJp:EtpC1GU2CQIhra1PKd6NIHXOJ

Score

10^/10

mystic redline lutyr infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1752-24-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral3/memory/1752-23-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral3/memory/1752-21-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2rh336DU.exe	family_redline
behavioral3/memory/2588-28-0x00000000008B0000-0x00000000008EE000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

Xw8HQ2vM.exelY9mL0gk.exe1NO74PL7.exe2rh336DU.exe

pid process

4632 Xw8HQ2vM.exe
1728 lY9mL0gk.exe
5016 1NO74PL7.exe
2588 2rh336DU.exe

pid	process
4632	Xw8HQ2vM.exe
1728	lY9mL0gk.exe
5016	1NO74PL7.exe
2588	2rh336DU.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exeXw8HQ2vM.exelY9mL0gk.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Xw8HQ2vM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	lY9mL0gk.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1NO74PL7.exe

description pid process target process

PID 5016 set thread context of 1752 5016 1NO74PL7.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3360 5016 WerFault.exe 1NO74PL7.exe

description	pid	process	target process
PID 5016 set thread context of 1752	5016	1NO74PL7.exe	AppLaunch.exe

pid	pid_target	process	target process
3360	5016	WerFault.exe	1NO74PL7.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exeXw8HQ2vM.exelY9mL0gk.exe1NO74PL7.exe

description	pid	process	target process
PID 4468 wrote to memory of 4632	4468	30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe	Xw8HQ2vM.exe
PID 4468 wrote to memory of 4632	4468	30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe	Xw8HQ2vM.exe
PID 4468 wrote to memory of 4632	4468	30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe	Xw8HQ2vM.exe
PID 4632 wrote to memory of 1728	4632	Xw8HQ2vM.exe	lY9mL0gk.exe
PID 4632 wrote to memory of 1728	4632	Xw8HQ2vM.exe	lY9mL0gk.exe
PID 4632 wrote to memory of 1728	4632	Xw8HQ2vM.exe	lY9mL0gk.exe
PID 1728 wrote to memory of 5016	1728	lY9mL0gk.exe	1NO74PL7.exe
PID 1728 wrote to memory of 5016	1728	lY9mL0gk.exe	1NO74PL7.exe
PID 1728 wrote to memory of 5016	1728	lY9mL0gk.exe	1NO74PL7.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 5016 wrote to memory of 1752	5016	1NO74PL7.exe	AppLaunch.exe
PID 1728 wrote to memory of 2588	1728	lY9mL0gk.exe	2rh336DU.exe
PID 1728 wrote to memory of 2588	1728	lY9mL0gk.exe	2rh336DU.exe
PID 1728 wrote to memory of 2588	1728	lY9mL0gk.exe	2rh336DU.exe

C:\Users\Admin\AppData\Local\Temp\30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe
"C:\Users\Admin\AppData\Local\Temp\30deda44ad7603ee8332ec9d0d3b2ac00c128de86e5239a94e2bb6d712e0fea8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xw8HQ2vM.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xw8HQ2vM.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lY9mL0gk.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lY9mL0gk.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1NO74PL7.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1NO74PL7.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:5016
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:1752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 152
        5⤵
        Program crash
        
        PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2rh336DU.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2rh336DU.exe
      4⤵
      Executes dropped EXE
      PID:2588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5016 -ip 5016
1⤵
PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Xw8HQ2vM.exe

Filesize
585KB

MD5
2ee5e4a00806d834c5f66cc530079529

SHA1
ef959a2656737768e0344ea30d6b2f0b4e1492f8

SHA256
9c6c3019f56bbeb336c6582f9eb50a13119c66d78466f98e3613e1f2e7395b7d

SHA512
7c9f4d1669e1a7538d54fa6ca60d47581676777dc58a75dd77ca4509088cbd33d930a4913bf2b4e4055f861181ce4eb0ab231e3729b00774b80b9c750ab20899

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\lY9mL0gk.exe

Filesize
413KB

MD5
6c4864b47b3d321384bee56a44edfd85

SHA1
eadc96a9982040175ae6eaa87efa2f35b7b15a34

SHA256
84f029ee6ccd55e1daa08d834e7e7cbc6862d6bac59906a60911cb3876efe42a

SHA512
1ef3ea4225b2e9f781d1ec2ce6e7914ba996b757f464c57b52928e0c521eb8ae9b8995e748ff2e1749ab92752d8a1c1d813a78f8bcd7a850fe0b100a3194a595

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1NO74PL7.exe

Filesize
378KB

MD5
42f66f3976aa5c14fe644bbdb3ebf7f4

SHA1
f6d3a99d45c13559f8d478234d3bfb14c2278ab1

SHA256
ff2561f6df847478ce0a417b13853418ac63456bc61a1e4399ab8074fdd2062b

SHA512
e6624701d6c93ca6c8554bf5e478d00162318415293c34bcaef0715e5c285c7235fb49c9c9f6732e1909f908a1a0a1ca2cb2950b1fdb2f26b9919884fb2eec90

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2rh336DU.exe

Filesize
221KB

MD5
0288648a07286c7f015a4532f9399a48

SHA1
0088bd95d23807b6ebd5cee00cd303ea1ad06ad1

SHA256
68388a86d9ee9d7cb5f16c84f5c8910774f55ed93ae07e80e4fe1080e6ddaee6

SHA512
6c1254faad1ffaacc7020a28b4a863d9560432af18b7e63a2aad08204f1595ab518a2502b0499b23cfce4e98f56a47d910e89171deb498986392deec39dad2fb

Download Submit
memory/1752-24-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1752-23-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1752-21-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2588-29-0x0000000007C20000-0x00000000081C4000-memory.dmp

Filesize
5.6MB

Download
memory/2588-28-0x00000000008B0000-0x00000000008EE000-memory.dmp

Filesize
248KB

Download
memory/2588-30-0x0000000007710000-0x00000000077A2000-memory.dmp

Filesize
584KB

Download
memory/2588-31-0x0000000002B60000-0x0000000002B6A000-memory.dmp

Filesize
40KB

Download
memory/2588-32-0x00000000087F0000-0x0000000008E08000-memory.dmp

Filesize
6.1MB

Download
memory/2588-33-0x0000000007AA0000-0x0000000007BAA000-memory.dmp

Filesize
1.0MB

Download
memory/2588-34-0x00000000076D0000-0x00000000076E2000-memory.dmp

Filesize
72KB

Download
memory/2588-35-0x00000000077F0000-0x000000000782C000-memory.dmp

Filesize
240KB

Download
memory/2588-36-0x0000000007830000-0x000000000787C000-memory.dmp

Filesize
304KB

Download