mystic | cc5e37d73955fc0316a074c4b20f0296dee40952f8d275b2c6c6eb4eb0947059

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe
Size

1.1MB
MD5

805fab0520813f1daf4cbaa9fed21d46
SHA1

209a066865bcf0daae7ec4460d26bc20ea4d6eaa
SHA256

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b
SHA512

7f561ac50b702e66d983cb35ecee637b6481956cb254e71990b5d6db5cd9fd08044015e6483ad46d39d39177f8a566eee4ec1d37c2f84fe99ad65bdd037e3217
SSDEEP

24576:OyCh/1QpnUZKnb8nOaEt0M7JQWXZVbtrwcwRhadKLT:dIUxL0qucwcwRhad

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral14/memory/4860-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral14/memory/4860-38-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral14/memory/4860-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jF540Op.exe	family_redline
behavioral14/memory/4876-42-0x00000000002D0000-0x000000000030E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

Processes:

TA0uZ8pS.exeLU7Ng5Gw.exehQ5SB7vc.exezp6le0rt.exe1JX71RM7.exe2jF540Op.exe

pid process

740 TA0uZ8pS.exe
1084 LU7Ng5Gw.exe
3624 hQ5SB7vc.exe
1728 zp6le0rt.exe
932 1JX71RM7.exe
4876 2jF540Op.exe

pid	process
740	TA0uZ8pS.exe
1084	LU7Ng5Gw.exe
3624	hQ5SB7vc.exe
1728	zp6le0rt.exe
932	1JX71RM7.exe
4876	2jF540Op.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exeTA0uZ8pS.exeLU7Ng5Gw.exehQ5SB7vc.exezp6le0rt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	TA0uZ8pS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	LU7Ng5Gw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	hQ5SB7vc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	zp6le0rt.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1JX71RM7.exe

description pid process target process

PID 932 set thread context of 4860 932 1JX71RM7.exe AppLaunch.exe

description	pid	process	target process
PID 932 set thread context of 4860	932	1JX71RM7.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exeTA0uZ8pS.exeLU7Ng5Gw.exehQ5SB7vc.exezp6le0rt.exe1JX71RM7.exe

description	pid	process	target process
PID 1236 wrote to memory of 740	1236	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe	TA0uZ8pS.exe
PID 1236 wrote to memory of 740	1236	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe	TA0uZ8pS.exe
PID 1236 wrote to memory of 740	1236	c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe	TA0uZ8pS.exe
PID 740 wrote to memory of 1084	740	TA0uZ8pS.exe	LU7Ng5Gw.exe
PID 740 wrote to memory of 1084	740	TA0uZ8pS.exe	LU7Ng5Gw.exe
PID 740 wrote to memory of 1084	740	TA0uZ8pS.exe	LU7Ng5Gw.exe
PID 1084 wrote to memory of 3624	1084	LU7Ng5Gw.exe	hQ5SB7vc.exe
PID 1084 wrote to memory of 3624	1084	LU7Ng5Gw.exe	hQ5SB7vc.exe
PID 1084 wrote to memory of 3624	1084	LU7Ng5Gw.exe	hQ5SB7vc.exe
PID 3624 wrote to memory of 1728	3624	hQ5SB7vc.exe	zp6le0rt.exe
PID 3624 wrote to memory of 1728	3624	hQ5SB7vc.exe	zp6le0rt.exe
PID 3624 wrote to memory of 1728	3624	hQ5SB7vc.exe	zp6le0rt.exe
PID 1728 wrote to memory of 932	1728	zp6le0rt.exe	1JX71RM7.exe
PID 1728 wrote to memory of 932	1728	zp6le0rt.exe	1JX71RM7.exe
PID 1728 wrote to memory of 932	1728	zp6le0rt.exe	1JX71RM7.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 932 wrote to memory of 4860	932	1JX71RM7.exe	AppLaunch.exe
PID 1728 wrote to memory of 4876	1728	zp6le0rt.exe	2jF540Op.exe
PID 1728 wrote to memory of 4876	1728	zp6le0rt.exe	2jF540Op.exe
PID 1728 wrote to memory of 4876	1728	zp6le0rt.exe	2jF540Op.exe

C:\Users\Admin\AppData\Local\Temp\c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe
"C:\Users\Admin\AppData\Local\Temp\c1237a6a46458518390f044aae909d7b4e395ae64c6bb1db16e0cbe581f8d65b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TA0uZ8pS.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TA0uZ8pS.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:740
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LU7Ng5Gw.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LU7Ng5Gw.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hQ5SB7vc.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hQ5SB7vc.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zp6le0rt.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zp6le0rt.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JX71RM7.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JX71RM7.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:932
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4860
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jF540Op.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jF540Op.exe
        6⤵
        Executes dropped EXE
        
        PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\TA0uZ8pS.exe

Filesize
1.0MB

MD5
8e56ad3e7626b33b61786b2921afa11c

SHA1
6d5c6e87aec120834f324664692b6c073f184510

SHA256
b56ab7f4f7977c68f371fc0fa6a32db37e38efce96a229a894d7a5b138b962c4

SHA512
b80356df83c6442448b62c40f3720cbf797096a631ddb9c2e8ebf613caec812e4a962553988fe909b0676862c09bdb73c85826cea93642db5a66b335c3365b09

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\LU7Ng5Gw.exe

Filesize
844KB

MD5
521614794d1f10f1d03bd2f1408ebabe

SHA1
8f597079e5ed3315837d282334374542fcb06931

SHA256
f80fe0908a94a0bfb3cf3c304c931d5f8ce593f759b28abc5b9047af23e9cf7b

SHA512
9cdef3edbb9aa91b17badad45a4909f2c81a9a852a92282a445e56f30b30076928311bce7dc7b95e4b6e062e1d487b702aabb4b02ab17c0e66ce1b2ed45604ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\hQ5SB7vc.exe

Filesize
593KB

MD5
6ed5ae9a75d6c0fc57086f9ab4371a20

SHA1
df94b083ae386775b62d602bc46252d4331f98a6

SHA256
cba59ce33be89d23e609afec0a1524d0d702d9d3fc3e13245b0638c93ca062f0

SHA512
23c30dfb149df017b7957fb59740807c8aa7f7326647061e5465cfb1faad05212b0021f410197d1fcb2000476e4df4bec3203a0ff56e34ae45ddf095f8aa2507

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zp6le0rt.exe

Filesize
398KB

MD5
61573360f6f8f9eef48a0f8054af8a8c

SHA1
414cf2050e7ffafeba37c62a8a553e18b3e97e14

SHA256
22b69144bd7d463b8084a91a5d296c1dbdf270abf12df328be19b72f49bb0ccf

SHA512
5629c12c9ed4c591ac9ac618b6be741ee2bec9edf18561d12ae3a94f7a3849939c6bef72f3c7039d9f944a3382b1ecfa2fff007e05787105849ae3b6985dd6da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1JX71RM7.exe

Filesize
320KB

MD5
058c82cf21c2d1da30146d61436aab48

SHA1
8fb443d6edc6267d8ee9a76b2ed002a4bc401413

SHA256
665dcca8deea4344514ffc018fc4b3997567f7189532b9e30ac89035137cbc05

SHA512
38a0227a33b93434f61ebbfac6da78950c98fbac30a4e26e2900807552e37fab0ef8f6cda6f4d74aaf1464153f4da4b70580f5d75afdb73219633f9817229dd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2jF540Op.exe

Filesize
222KB

MD5
713fca92710c7747cbfc342aa75bebdb

SHA1
036b25061a1c898f35beae11401d0f6245f375b2

SHA256
0a38179bdae0cd104c4a2a2ec1132ee49272e8e841b8cafb23ecd13bbcbc9e57

SHA512
e058c03012618b45e8fd032d2248afe683891923ed1c41975d2d6a3e334b07e433b1bc28a2dcc4614f442a8e7568c6b3397e1702c56edc42fefb46536ce518e9

Download Submit
memory/4860-38-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4860-36-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4860-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4876-42-0x00000000002D0000-0x000000000030E000-memory.dmp

Filesize
248KB

Download
memory/4876-43-0x0000000007720000-0x0000000007CC4000-memory.dmp

Filesize
5.6MB

Download
memory/4876-44-0x0000000007210000-0x00000000072A2000-memory.dmp

Filesize
584KB

Download
memory/4876-45-0x0000000002620000-0x000000000262A000-memory.dmp

Filesize
40KB

Download
memory/4876-46-0x00000000082F0000-0x0000000008908000-memory.dmp

Filesize
6.1MB

Download
memory/4876-47-0x0000000007530000-0x000000000763A000-memory.dmp

Filesize
1.0MB

Download
memory/4876-48-0x00000000073C0000-0x00000000073D2000-memory.dmp

Filesize
72KB

Download
memory/4876-49-0x0000000007460000-0x000000000749C000-memory.dmp

Filesize
240KB

Download
memory/4876-50-0x00000000074A0000-0x00000000074EC000-memory.dmp

Filesize
304KB

Download