mystic | 60fcc3045e1b1073753937ff8c184c464a45ea76225a406024335c07f898cf7b

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe
Size

350KB
MD5

37e7e8390e29fb07765008452e6a4f90
SHA1

c5691bbf4985fa0ab3085608afe408f090313eab
SHA256

9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f
SHA512

42c014e0bcb2957a9bb6ba1331fe0c71123489dddbdcc2b4e6b853dfb3b5b5c28d7eb0e02b021a73c036843d01cba0faca91209faf68d82f0cb424c24590d1b8
SSDEEP

6144:KMy+bnr+3p0yN90QEM4SGRawgsb+NpItzys+F2wccwijev6TXHEw:MMr/y90KtGRat9HEzh+4vcbyv6T3P

Score

10^/10

mystic redline luska infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

luska

77.91.124.55:19071

Attributes

auth_value
a6797888f51a88afbfd8854a79ac9357

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral12/memory/3972-7-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral12/memory/3972-11-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral12/memory/3972-9-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral12/memory/3972-8-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral12/files/0x00070000000234b7-13.dat	family_redline
behavioral12/memory/2072-16-0x0000000000840000-0x0000000000870000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
2692	g8268247.exe
2072	h4856682.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2692 set thread context of 3972	2692	g8268247.exe	85

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4240	3972	WerFault.exe	85
5052	2692	WerFault.exe	83

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2692	2000	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe	83
PID 2000 wrote to memory of 2692	2000	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe	83
PID 2000 wrote to memory of 2692	2000	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe	83
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2692 wrote to memory of 3972	2692	g8268247.exe	85
PID 2000 wrote to memory of 2072	2000	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe	94
PID 2000 wrote to memory of 2072	2000	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe	94
PID 2000 wrote to memory of 2072	2000	9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe	94

C:\Users\Admin\AppData\Local\Temp\9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe
"C:\Users\Admin\AppData\Local\Temp\9ea70f7e17c798e669e7b4c1c1f53cdd9a2781bb6ba453a9c084bf3392b8585f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g8268247.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g8268247.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3972
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 540
      4⤵
      Program crash
      PID:4240
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2692 -s 584
    3⤵
    - Program crash
    PID:5052
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4856682.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4856682.exe
  2⤵
  - Executes dropped EXE
  PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3972 -ip 3972
1⤵
PID:1232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2692 -ip 2692
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\g8268247.exe

Filesize
276KB

MD5
1eefd3a8818ceade05d922c801f21972

SHA1
a6fdee407a9100175b12ef38bdf4e33b09868e46

SHA256
3dfa43d284d7c8d057cdecd8bcccb2b7b5c31e4c5e937e0a1fd2da05bb2e10de

SHA512
3e5a0e6f29d90dd9540eb60736e3f9c61678077524778e3bbaaf5f1353022be1cfca9f7df96caf3d335fc55f95078246ed5fb608b5eb12fd8cb95f5ac9f43fbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\h4856682.exe

Filesize
174KB

MD5
3daf26eb42f969481af6b1d9c3e0e06d

SHA1
20f1963525a56ee623e74e016683a48976aedee9

SHA256
f4732c08573a7269198ea8e9f3211d82651c30a8525b58107c15428c43a4f34e

SHA512
4e4e37aab2f20f70e8ed4c861ceae399ebfbc837a15ccae760fdd157a29cf5e8523add76722fddb2380fbf9cfdfcc654b873dd1823e759c1adb1b6bfe2669d5d

Download Submit
memory/2072-21-0x000000000A650000-0x000000000A68C000-memory.dmp

Filesize
240KB

Download
memory/2072-18-0x000000000AB60000-0x000000000B178000-memory.dmp

Filesize
6.1MB

Download
memory/2072-25-0x00000000741A0000-0x0000000074950000-memory.dmp

Filesize
7.7MB

Download
memory/2072-24-0x00000000741AE000-0x00000000741AF000-memory.dmp

Filesize
4KB

Download
memory/2072-15-0x00000000741AE000-0x00000000741AF000-memory.dmp

Filesize
4KB

Download
memory/2072-16-0x0000000000840000-0x0000000000870000-memory.dmp

Filesize
192KB

Download
memory/2072-17-0x0000000002AE0000-0x0000000002AE6000-memory.dmp

Filesize
24KB

Download
memory/2072-23-0x0000000002B40000-0x0000000002B8C000-memory.dmp

Filesize
304KB

Download
memory/2072-19-0x000000000A6B0000-0x000000000A7BA000-memory.dmp

Filesize
1.0MB

Download
memory/2072-20-0x000000000A5F0000-0x000000000A602000-memory.dmp

Filesize
72KB

Download
memory/2072-22-0x00000000741A0000-0x0000000074950000-memory.dmp

Filesize
7.7MB

Download
memory/3972-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3972-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3972-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3972-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads