mystic | cc5e37d73955fc0316a074c4b20f0296dee40952f8d275b2c6c6eb4eb0947059

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe
Size

692KB
MD5

75d4d328a799d98cbfc1e833cd018aca
SHA1

9d5dcb6ccfb99ed7ec5dcc77bbf544c71ade5e04
SHA256

d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97
SHA512

a5be29a9ef0c570c2328782d7a017152d78402c7314c6acd93ead929553bd40caf98fb229e92c71b88fecbf80ff75cd5dbf0979d956c5035313d42d745d99ba6
SSDEEP

12288:+Mrsy902LH5YQp71v571GYKcrw1DHY88Up2VsK35LdPUO7K2avsVjA5vyQ:uyjH53Q9Ydc2Vsw4O7PavspEvyQ

Score

10^/10

mystic redline smokeloader taiga backdoor infostealer persistence stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://5.42.92.190/fks/index.php

rc4.i32

Extracted

Family

redline

Botnet

taiga

5.42.92.51:19057

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral15/memory/5088-21-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral15/memory/5088-23-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral15/memory/5088-22-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral15/memory/5088-25-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral15/memory/3944-37-0x0000000000400000-0x000000000043C000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7Hj8qJ52.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7Hj8qJ52.exe

Executes dropped EXE 6 IoCs

Processes:

tQ4qW80.exeJH3Ii76.exe1Gh46bO4.exe2Hh5531.exe6Zk7uY1.exe7Hj8qJ52.exe

pid process

2940 tQ4qW80.exe
908 JH3Ii76.exe
1800 1Gh46bO4.exe
4756 2Hh5531.exe
1648 6Zk7uY1.exe
3644 7Hj8qJ52.exe

pid	process
2940	tQ4qW80.exe
908	JH3Ii76.exe
1800	1Gh46bO4.exe
4756	2Hh5531.exe
1648	6Zk7uY1.exe
3644	7Hj8qJ52.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exetQ4qW80.exeJH3Ii76.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	tQ4qW80.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	JH3Ii76.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1Gh46bO4.exe6Zk7uY1.exe

description	pid	process	target process
PID 1800 set thread context of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1648 set thread context of 3944	1648	6Zk7uY1.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2Hh5531.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2Hh5531.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2Hh5531.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2Hh5531.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2Hh5531.exe

pid	process
4756	2Hh5531.exe
4756	2Hh5531.exe
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

2Hh5531.exe

pid process

4756 2Hh5531.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exetQ4qW80.exeJH3Ii76.exe1Gh46bO4.exe6Zk7uY1.exe7Hj8qJ52.exe

description	pid	process	target process
PID 3252 wrote to memory of 2940	3252	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe	tQ4qW80.exe
PID 3252 wrote to memory of 2940	3252	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe	tQ4qW80.exe
PID 3252 wrote to memory of 2940	3252	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe	tQ4qW80.exe
PID 2940 wrote to memory of 908	2940	tQ4qW80.exe	JH3Ii76.exe
PID 2940 wrote to memory of 908	2940	tQ4qW80.exe	JH3Ii76.exe
PID 2940 wrote to memory of 908	2940	tQ4qW80.exe	JH3Ii76.exe
PID 908 wrote to memory of 1800	908	JH3Ii76.exe	1Gh46bO4.exe
PID 908 wrote to memory of 1800	908	JH3Ii76.exe	1Gh46bO4.exe
PID 908 wrote to memory of 1800	908	JH3Ii76.exe	1Gh46bO4.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 1800 wrote to memory of 5088	1800	1Gh46bO4.exe	AppLaunch.exe
PID 908 wrote to memory of 4756	908	JH3Ii76.exe	2Hh5531.exe
PID 908 wrote to memory of 4756	908	JH3Ii76.exe	2Hh5531.exe
PID 908 wrote to memory of 4756	908	JH3Ii76.exe	2Hh5531.exe
PID 2940 wrote to memory of 1648	2940	tQ4qW80.exe	6Zk7uY1.exe
PID 2940 wrote to memory of 1648	2940	tQ4qW80.exe	6Zk7uY1.exe
PID 2940 wrote to memory of 1648	2940	tQ4qW80.exe	6Zk7uY1.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 1648 wrote to memory of 3944	1648	6Zk7uY1.exe	AppLaunch.exe
PID 3252 wrote to memory of 3644	3252	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe	7Hj8qJ52.exe
PID 3252 wrote to memory of 3644	3252	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe	7Hj8qJ52.exe
PID 3252 wrote to memory of 3644	3252	d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe	7Hj8qJ52.exe
PID 3644 wrote to memory of 4992	3644	7Hj8qJ52.exe	cmd.exe
PID 3644 wrote to memory of 4992	3644	7Hj8qJ52.exe	cmd.exe
PID 3644 wrote to memory of 4992	3644	7Hj8qJ52.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe
"C:\Users\Admin\AppData\Local\Temp\d7fde0f5efb7f555528ff1c98946e36088ec7396d07c4fd0a577c6b49c4bcd97.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3252

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ4qW80.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ4qW80.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2940

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\JH3Ii76.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\JH3Ii76.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:908

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Gh46bO4.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Gh46bO4.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:5088

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Hh5531.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Hh5531.exe
4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4756

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Zk7uY1.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Zk7uY1.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:3944

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Hj8qJ52.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Hj8qJ52.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\is64.bat" "
3⤵
PID:4992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2180,i,12780723798465539942,12010519452607841069,262144 --variations-seed-version /prefetch:8
1⤵
PID:416

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\7Hj8qJ52.exe
Filesize
73KB

MD5
a28ed2ac0c0a94b54387ff778c53ad8a

SHA1
a1f89a10abfa0b634b8f2bab5c6c36ea4b896a7c

SHA256
7355315a3dd67db940ff33175cc9a497a6e930459d1a2b07fce262ab1f35e4c7

SHA512
894b411693e83fb08f42d6733ce69b908ce6b75914be982a65e63f2b814db81a9ca8b00a618099d6c7768e8bc2cae0164fcf7775868b372c60367263b5fff0a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tQ4qW80.exe
Filesize
570KB

MD5
258c34fb175bb0a922ef55ee8b03adc7

SHA1
2bd4f1a395c96f57178ec9d70def366ecd635368

SHA256
6c0a1fddb04192b9dd88ca4ae67448be4376522c8bb9aed8fc207337cd513005

SHA512
8946f4648ea7cb711799974617f67a1187663907dab8ec5dcb3bd23004774bb59bc063d958a8a0fbd5b726b83dd6afda9ef7c6d83b4d896d003542e663aec3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\6Zk7uY1.exe
Filesize
339KB

MD5
14d9834611ad581afcfea061652ff6cb

SHA1
802f964d0be7858eb2f1e7c6fcda03501fd1b71c

SHA256
e6e9b3d830f2d7860a09d596576e8ab0131c527b47dda73fe727b71b44c8cf60

SHA512
cbef1f44eb76d719c60d857a567a3fc700d62751111337cd4f8d30deae6901dc361320f28dac5ec5468420419eed66cada20f4c90fe07db6a3f8cf959eba31b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\JH3Ii76.exe
Filesize
334KB

MD5
ca81d36a363d41416aa90c0bb799f06e

SHA1
b24ca258953689eb4b1a711dc3363f8d0ffc4e8a

SHA256
9f585bbc216ba40e21ea9d8fd66ec88793ae5b39c9883837c26c9287575bc15a

SHA512
4a451539d68f10d5de5ccfce41d529cd0c39e226f3365f33b933dddbf40868748dbeccbcf1ebce4e9692a72825896640ad71c67a89165f7a3f534337103cb678

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Gh46bO4.exe
Filesize
300KB

MD5
784667bb96ccb30c4cf44f2c5f493769

SHA1
28185165ab4dbbb4a139ae1af0bb6934ebe05c04

SHA256
1025fb084bca865df30e69eea7a9a4a3c852626e148b340de661e6f5b63bc1c9

SHA512
62c9def097f132cdb26b11e586f3e15407b9eb9e9e32f79460a3be1bd4c8e046db8488f754cd1c1cc4fe4025a3f9bc9484e94eae0c7d273050f8e6548d12bc20

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Hh5531.exe
Filesize
37KB

MD5
b938034561ab089d7047093d46deea8f

SHA1
d778c32cc46be09b107fa47cf3505ba5b748853d

SHA256
260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161

SHA512
4909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.bat
Filesize
181B

MD5
225edee1d46e0a80610db26b275d72fb

SHA1
ce206abf11aaf19278b72f5021cc64b1b427b7e8

SHA256
e1befb57d724c9dc760cf42d7e0609212b22faeb2dc0c3ffe2fbd7134ff69559

SHA512
4f01a2a248a1322cb690b7395b818d2780e46f4884e59f1ab96125d642b6358eea97c7fad6023ef17209b218daa9c88d15ea2b92f124ecb8434c0c7b4a710504

Download Submit
C:\Users\Admin\AppData\Local\Temp\is64.txt
Filesize
3B

MD5
a5ea0ad9260b1550a14cc58d2c39b03d

SHA1
f0aedf295071ed34ab8c6a7692223d22b6a19841

SHA256
f1b2f662800122bed0ff255693df89c4487fbdcf453d3524a42d4ec20c3d9c04

SHA512
7c735c613ece191801114785c1ee26a0485cbf1e8ee2c3b85ba1ad290ef75eec9fede5e1a5dc26d504701f3542e6b6457818f4c1d62448d0db40d5f35c357d74

Download Submit
memory/3428-30-0x0000000002590000-0x00000000025A6000-memory.dmp

Filesize
88KB

Download
memory/3944-52-0x0000000007B80000-0x0000000007B8A000-memory.dmp

Filesize
40KB

Download
memory/3944-54-0x0000000008550000-0x000000000865A000-memory.dmp

Filesize
1.0MB

Download
memory/3944-37-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3944-43-0x0000000007FA0000-0x0000000008544000-memory.dmp

Filesize
5.6MB

Download
memory/3944-45-0x0000000007AD0000-0x0000000007B62000-memory.dmp

Filesize
584KB

Download
memory/3944-57-0x0000000007F40000-0x0000000007F8C000-memory.dmp

Filesize
304KB

Download
memory/3944-56-0x0000000007F00000-0x0000000007F3C000-memory.dmp

Filesize
240KB

Download
memory/3944-55-0x0000000007EA0000-0x0000000007EB2000-memory.dmp

Filesize
72KB

Download
memory/3944-53-0x0000000008B70000-0x0000000009188000-memory.dmp

Filesize
6.1MB

Download
memory/4756-28-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4756-33-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/5088-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5088-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download