mystic | ddc6b496a8a25762ee7b933f47107c5553187f5846568bf68b67dd8d5f4a7548

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe
Size

383KB
MD5

6ba04314f4ed46576cd545308fade99d
SHA1

26115ecbd1dc9d403c5c447e41f34afee5aae962
SHA256

16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea
SHA512

8018b3fa58c041d40decd6dc93e4ce33bcb7fd6550147735d35dc1032c158e145a7d150e0906a09f0d73925c96bfd210190aa7cec280eef132bdfdff25c49f90
SSDEEP

6144:KKy+bnr+lp0yN90QEMYuezbbTMDy00FkyGWydCzQBM2MzMB/+y8s:6MrFy90rcVyIdCmMKB

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral3/memory/1380-7-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral3/memory/1380-8-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral3/memory/1380-9-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral3/memory/1380-11-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2xj796eI.exe	family_redline
behavioral3/memory/4104-16-0x0000000000D70000-0x0000000000DAE000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

1wq36tS5.exe2xj796eI.exe

pid process

216 1wq36tS5.exe
4104 2xj796eI.exe

pid	process
216	1wq36tS5.exe
4104	2xj796eI.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1wq36tS5.exe

description pid process target process

PID 216 set thread context of 1380 216 1wq36tS5.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2220 216 WerFault.exe 1wq36tS5.exe
3988 1380 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 216 set thread context of 1380	216	1wq36tS5.exe	AppLaunch.exe

pid	pid_target	process	target process
2220	216	WerFault.exe	1wq36tS5.exe
3988	1380	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe1wq36tS5.exe

description	pid	process	target process
PID 3024 wrote to memory of 216	3024	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe	1wq36tS5.exe
PID 3024 wrote to memory of 216	3024	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe	1wq36tS5.exe
PID 3024 wrote to memory of 216	3024	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe	1wq36tS5.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 216 wrote to memory of 1380	216	1wq36tS5.exe	AppLaunch.exe
PID 3024 wrote to memory of 4104	3024	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe	2xj796eI.exe
PID 3024 wrote to memory of 4104	3024	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe	2xj796eI.exe
PID 3024 wrote to memory of 4104	3024	16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe	2xj796eI.exe

C:\Users\Admin\AppData\Local\Temp\16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe
"C:\Users\Admin\AppData\Local\Temp\16ac715816f3482cfc24aaddcdcd5f3994bb21599090c021f66c1dce047523ea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1wq36tS5.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1wq36tS5.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 560
4⤵
- Program crash
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 216 -s 572
3⤵
- Program crash
PID:2220

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2xj796eI.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2xj796eI.exe
2⤵
- Executes dropped EXE
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1380 -ip 1380
1⤵
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 216 -ip 216
1⤵
PID:4360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1wq36tS5.exe
Filesize
298KB

MD5
858db843f45a0182ca8495231a19d97c

SHA1
7c47a84710ed584697a502e0a7db46a8b7e591b2

SHA256
35ae42f9d25d6d46c75ec0f2550fe5eaace91f2d1bd946e3fc9e71e4221e2b91

SHA512
eed5c4d7402239387e9eaef4016b963ba035c89235ee41511de55af93f5687c087a4edb0dff526948c4d43c9234a45c50ec0b361f3ad00948ee83f9c5e69b917

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2xj796eI.exe
Filesize
222KB

MD5
a63da022e5cc8e8f377857fc42766176

SHA1
74785ef802637e53e4cbec2c6c9cf39733738db6

SHA256
3f494070cb5937094d2bd14d16701c6ec430e6f6ffef1eb9f1f2d2a1510a4f61

SHA512
d4cddd49f4f1542106d7c60c3fcc699c317d95eb02f35958fc8e5d056c08aaecb9c5dc24133c669e51765db9ea628d7aff32f9cab3c5f0f8dfa1e6b11f64517d

Download Submit
memory/1380-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1380-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1380-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1380-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4104-17-0x0000000008010000-0x00000000085B4000-memory.dmp

Filesize
5.6MB

Download
memory/4104-16-0x0000000000D70000-0x0000000000DAE000-memory.dmp

Filesize
248KB

Download
memory/4104-15-0x000000007403E000-0x000000007403F000-memory.dmp

Filesize
4KB

Download
memory/4104-18-0x0000000007B40000-0x0000000007BD2000-memory.dmp

Filesize
584KB

Download
memory/4104-19-0x0000000005100000-0x000000000510A000-memory.dmp

Filesize
40KB

Download
memory/4104-20-0x0000000074030000-0x00000000747E0000-memory.dmp

Filesize
7.7MB

Download
memory/4104-21-0x0000000008BE0000-0x00000000091F8000-memory.dmp

Filesize
6.1MB

Download
memory/4104-22-0x0000000007EC0000-0x0000000007FCA000-memory.dmp

Filesize
1.0MB

Download
memory/4104-23-0x0000000007C30000-0x0000000007C42000-memory.dmp

Filesize
72KB

Download
memory/4104-24-0x0000000007DB0000-0x0000000007DEC000-memory.dmp

Filesize
240KB

Download
memory/4104-25-0x0000000007C60000-0x0000000007CAC000-memory.dmp

Filesize
304KB

Download
memory/4104-26-0x000000007403E000-0x000000007403F000-memory.dmp

Filesize
4KB

Download
memory/4104-27-0x0000000074030000-0x00000000747E0000-memory.dmp

Filesize
7.7MB

Download