mystic | 60fcc3045e1b1073753937ff8c184c464a45ea76225a406024335c07f898cf7b

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe
Size

746KB
MD5

e3f0d90b107883fbbbfbe142e1ab47f4
SHA1

1e3e3f873a4e9305f18c9771b4e0d450af3ecc51
SHA256

06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0
SHA512

8c7ecf4381874c826ab6ed2ddc25f03a011244047050fd47b6e0756c3131c4c3fc59d9fca1bf560985f21928250ab7e93904e867d03324cf8f88e82f9aadb5dd
SSDEEP

12288:SMryy90/mlGgt30uj4mL1ab2zakYgLkh2CEcOD0UPpBvlkDEQDQexUVJaOSBrxR:Ey+mlkuDL5zoh2CEcOYGhl9wQexUrfSN

Score

10^/10

mystic redline frant evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

frant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/4640-54-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/4640-55-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral1/memory/4640-57-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1Cb13rC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Cb13rC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Cb13rC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Cb13rC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Cb13rC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Cb13rC5.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3668-61-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1228	ZZ0Do30.exe
628	1Cb13rC5.exe
536	2VS58Mz.exe
2900	3ni3596.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1Cb13rC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Cb13rC5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ZZ0Do30.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 536 set thread context of 4640	536	2VS58Mz.exe	107
PID 2900 set thread context of 3668	2900	3ni3596.exe	113

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3940	536	WerFault.exe	105
2052	2900	WerFault.exe	111

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
628	1Cb13rC5.exe
628	1Cb13rC5.exe
628	1Cb13rC5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	628	1Cb13rC5.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1228	2868	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe	91
PID 2868 wrote to memory of 1228	2868	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe	91
PID 2868 wrote to memory of 1228	2868	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe	91
PID 1228 wrote to memory of 628	1228	ZZ0Do30.exe	92
PID 1228 wrote to memory of 628	1228	ZZ0Do30.exe	92
PID 1228 wrote to memory of 628	1228	ZZ0Do30.exe	92
PID 1228 wrote to memory of 536	1228	ZZ0Do30.exe	105
PID 1228 wrote to memory of 536	1228	ZZ0Do30.exe	105
PID 1228 wrote to memory of 536	1228	ZZ0Do30.exe	105
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 536 wrote to memory of 4640	536	2VS58Mz.exe	107
PID 2868 wrote to memory of 2900	2868	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe	111
PID 2868 wrote to memory of 2900	2868	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe	111
PID 2868 wrote to memory of 2900	2868	06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe	111
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113
PID 2900 wrote to memory of 3668	2900	3ni3596.exe	113

C:\Users\Admin\AppData\Local\Temp\06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe
"C:\Users\Admin\AppData\Local\Temp\06d3b7d2ba41c5f96bf4cfe6d91d8f9145e4e461450c303c8a12719d8d4746d0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZZ0Do30.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZZ0Do30.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Cb13rC5.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Cb13rC5.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:628
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2VS58Mz.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2VS58Mz.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:536
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 156
      4⤵
      Program crash
      PID:3940
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3ni3596.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3ni3596.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 164
    3⤵
    - Program crash
    PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3240,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
1⤵
PID:4892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 536 -ip 536
1⤵
PID:2124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2900 -ip 2900
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3ni3596.exe

Filesize
459KB

MD5
02b371cb14ef91f51766852bd2827639

SHA1
e592fe8e167fdd2706f37694ff8c4b8e7b0c3281

SHA256
59d582744581c452600a8065ea94d5cbf67d382a80e3e3e314a040395fba7e1d

SHA512
76e0fdf30923a51853c2626ec9defc77b4792d6eda0406d0d6ea25fdc01f75e8758a02197d39a45f2d3c8360c5e0b0e17ea9b5c607797414d6631a6d3ceb7d38

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ZZ0Do30.exe

Filesize
452KB

MD5
db66390881821130485edf75921a51f3

SHA1
12e9df5a7c4533612b31d4b8bd1f350cbe5d97f8

SHA256
a3cf4bbd205c41945f6f4cff73132323aba004df266558cb55f68d692c440307

SHA512
223f5698922b1f696e7496d13dfe29b2eb641af66a51353e828a4db8070223ed557fdb396bc67e186689057c6ac5687225cdf516fba18c125ce31e4aeb0b0bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Cb13rC5.exe

Filesize
192KB

MD5
8904f85abd522c7d0cb5789d9583ccff

SHA1
5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

SHA256
7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

SHA512
04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2VS58Mz.exe

Filesize
378KB

MD5
f74482bf23b72c42e068ae8aca948c3a

SHA1
8ead733fd2d3bc1bf0fe19ab320f3ec7a76b4e65

SHA256
6f2080bca1ca7751a3a4c4144688ca6f2d1ade554c3fb75c61d69d85f7443d41

SHA512
2b057ab6edaf9ea384c6e59a75270e3c78a16b8d253ebb88cea4a1062e26e4ed7fc9686636633115a6626de4ff74b22d33c23ba582df228f281a346062f14e1c

Download Submit
memory/628-29-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-23-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-18-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/628-19-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/628-47-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-45-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-48-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/628-43-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-41-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-39-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-35-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-33-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-31-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-16-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/628-27-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-25-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-17-0x0000000004C00000-0x00000000051A4000-memory.dmp

Filesize
5.6MB

Download
memory/628-21-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-20-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/628-50-0x00000000740D0000-0x0000000074880000-memory.dmp

Filesize
7.7MB

Download
memory/628-15-0x0000000002410000-0x000000000242E000-memory.dmp

Filesize
120KB

Download
memory/628-14-0x00000000740DE000-0x00000000740DF000-memory.dmp

Filesize
4KB

Download
memory/3668-61-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/3668-62-0x0000000007580000-0x0000000007612000-memory.dmp

Filesize
584KB

Download
memory/3668-63-0x0000000002890000-0x000000000289A000-memory.dmp

Filesize
40KB

Download
memory/3668-64-0x0000000008660000-0x0000000008C78000-memory.dmp

Filesize
6.1MB

Download
memory/3668-65-0x0000000008040000-0x000000000814A000-memory.dmp

Filesize
1.0MB

Download
memory/3668-66-0x00000000078D0000-0x00000000078E2000-memory.dmp

Filesize
72KB

Download
memory/3668-67-0x0000000007930000-0x000000000796C000-memory.dmp

Filesize
240KB

Download
memory/3668-68-0x0000000007970000-0x00000000079BC000-memory.dmp

Filesize
304KB

Download
memory/4640-55-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4640-57-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4640-54-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download