mystic | ffe8fa0cf1ed446eeb9dc6eef440d6e2121396f13b66e26a431adcd9f2d605e3

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe
Size

383KB
MD5

42d11f2b82dcb7347ed0e016f3a89be6
SHA1

70f25e34f96ecaee0d9758c0f4eaeca90547326e
SHA256

421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d
SHA512

019f1c83f86850232a165a0b70a3800d3d6e473f3ed697cb85b63d70a62cfc410bcded02a469becaf3588461293eeeb59ec20cde50e039fd36e0e42c7a9e07f2
SSDEEP

6144:KYy+bnr+Jp0yN90QEXyo3FxSHF3F32KnACJeQ2Ut86H5777+1wxjnblSkcy:wMrhy905ycMF3F322veyT577C1wxXcy

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral6/memory/3224-7-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral6/memory/3224-11-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral6/memory/3224-9-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral6/memory/3224-8-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral6/files/0x0007000000023444-13.dat	family_redline
behavioral6/memory/4324-16-0x0000000000290000-0x00000000002CE000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
2460	1Yc45hZ6.exe
4324	2yN492ew.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2460 set thread context of 3224	2460	1Yc45hZ6.exe	100

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3952	2460	WerFault.exe	84
3856	3224	WerFault.exe	100

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2460	4868	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe	84
PID 4868 wrote to memory of 2460	4868	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe	84
PID 4868 wrote to memory of 2460	4868	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe	84
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 2460 wrote to memory of 3224	2460	1Yc45hZ6.exe	100
PID 4868 wrote to memory of 4324	4868	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe	106
PID 4868 wrote to memory of 4324	4868	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe	106
PID 4868 wrote to memory of 4324	4868	421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe	106

C:\Users\Admin\AppData\Local\Temp\421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe
"C:\Users\Admin\AppData\Local\Temp\421c712a06e641733de7dc086abdc66469eef71d8cf926aa756f0f6910cd6a0d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Yc45hZ6.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Yc45hZ6.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:3224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 540
      4⤵
      Program crash
      PID:3856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 148
    3⤵
    - Program crash
    PID:3952
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2yN492ew.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2yN492ew.exe
  2⤵
  - Executes dropped EXE
  PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2460 -ip 2460
1⤵
PID:3368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3224 -ip 3224
1⤵
PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Yc45hZ6.exe

Filesize
298KB

MD5
21ee9d440ada28f026035d19948b293f

SHA1
21126b624c4d649f81588c2cbfe1c3eaea2650f5

SHA256
3fb12495e899710734c1cc2b6f1b4854db7c8bd100cc9a57444c917a5b1ab5d7

SHA512
246561d55a69de308a9fecfc27ca75a41897ff9ef33be4642afa8e52b3b6934a84e1ec71adbcf2f5fe29fc944f477d74ac5e2e2f204dbf94ec78292dc9bd9c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2yN492ew.exe

Filesize
222KB

MD5
daa86ce5f09ccd12a4b4624bcf464319

SHA1
caf2ef4c667f5580cee3ae06d39f881e4e1888a1

SHA256
c3b16a533e14f2d8967bbf5fd398641057878e328ed83a914368f67e2a791c8f

SHA512
661bbd45c2bedca136f8982416b8ce690549d9171e7e25f8f420521c852c175dfddbfcad2b196d202bbac3b79b2d63558b59540dfb6f9f175c0cffd2f5924940

Download Submit
memory/3224-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3224-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3224-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3224-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4324-17-0x00000000076A0000-0x0000000007C44000-memory.dmp

Filesize
5.6MB

Download
memory/4324-16-0x0000000000290000-0x00000000002CE000-memory.dmp

Filesize
248KB

Download
memory/4324-15-0x00000000739FE000-0x00000000739FF000-memory.dmp

Filesize
4KB

Download
memory/4324-18-0x0000000007190000-0x0000000007222000-memory.dmp

Filesize
584KB

Download
memory/4324-19-0x0000000004810000-0x000000000481A000-memory.dmp

Filesize
40KB

Download
memory/4324-20-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download
memory/4324-21-0x0000000008270000-0x0000000008888000-memory.dmp

Filesize
6.1MB

Download
memory/4324-23-0x0000000007380000-0x0000000007392000-memory.dmp

Filesize
72KB

Download
memory/4324-22-0x0000000007530000-0x000000000763A000-memory.dmp

Filesize
1.0MB

Download
memory/4324-24-0x0000000007420000-0x000000000745C000-memory.dmp

Filesize
240KB

Download
memory/4324-25-0x00000000073B0000-0x00000000073FC000-memory.dmp

Filesize
304KB

Download
memory/4324-26-0x00000000739FE000-0x00000000739FF000-memory.dmp

Filesize
4KB

Download
memory/4324-27-0x00000000739F0000-0x00000000741A0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads