mystic | cc5e37d73955fc0316a074c4b20f0296dee40952f8d275b2c6c6eb4eb0947059

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe
Size

640KB
MD5

83f05c5fda15836298e46fb4040f4c38
SHA1

63f0e9906de5027985d0bb31866535610e7da4d9
SHA256

3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7
SHA512

d47fff8e77915d9289f57b3768d82722ce888b2a11548ef6f83661729d56fbc2ac3128760d9a363c405ba0092d8c2713e8826df45d0d6b73dd125beeb6f80e9b
SSDEEP

12288:bMruy90Kr3s8LlcWABrlcjhrCWarqi8b+RdCGo6VE8+sjVyUQT:5ydc8LmBhIrzarqq06VEIyUo

Score

10^/10

mystic redline lutyr infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral6/memory/1876-14-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral6/memory/1876-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral6/memory/1876-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral6/memory/1876-16-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral6/files/0x000700000002342d-20.dat	family_redline
behavioral6/memory/4940-22-0x00000000008C0000-0x00000000008FE000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
4552	Ju2HW2iO.exe
2868	1Td93Hj8.exe
4940	2rA713vi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ju2HW2iO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2868 set thread context of 1876	2868	1Td93Hj8.exe	86

Program crash 2 IoCs

pid	pid_target	Process	procid_target
216	2868	WerFault.exe	84
1120	1876	WerFault.exe	86

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4552	2964	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe	83
PID 2964 wrote to memory of 4552	2964	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe	83
PID 2964 wrote to memory of 4552	2964	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe	83
PID 4552 wrote to memory of 2868	4552	Ju2HW2iO.exe	84
PID 4552 wrote to memory of 2868	4552	Ju2HW2iO.exe	84
PID 4552 wrote to memory of 2868	4552	Ju2HW2iO.exe	84
PID 2868 wrote to memory of 2972	2868	1Td93Hj8.exe	85
PID 2868 wrote to memory of 2972	2868	1Td93Hj8.exe	85
PID 2868 wrote to memory of 2972	2868	1Td93Hj8.exe	85
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 2868 wrote to memory of 1876	2868	1Td93Hj8.exe	86
PID 4552 wrote to memory of 4940	4552	Ju2HW2iO.exe	94
PID 4552 wrote to memory of 4940	4552	Ju2HW2iO.exe	94
PID 4552 wrote to memory of 4940	4552	Ju2HW2iO.exe	94

C:\Users\Admin\AppData\Local\Temp\3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe
"C:\Users\Admin\AppData\Local\Temp\3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ju2HW2iO.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ju2HW2iO.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Td93Hj8.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Td93Hj8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2972
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1876
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 540
        5⤵
        Program crash
        
        PID:1120
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 616
      4⤵
      Program crash
      PID:216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe
    3⤵
    - Executes dropped EXE
    PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2868 -ip 2868
1⤵
PID:4788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1876 -ip 1876
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ju2HW2iO.exe

Filesize
444KB

MD5
6b0e2c47872270341bd987ec04450b99

SHA1
da15aec4c4485cd3deda467b444c893f5e6c9616

SHA256
d29391ba6b121949ab4ca495bbb860cc0499d0b15a4093d67f9465d96b46e38e

SHA512
b1970fe9883ccabe0574839f7934adcec02465680af6464b62476ee46518ed101ea0e001574280525b55fc73fcca4abaa1bcadd09698533a7ee270449bb67a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Td93Hj8.exe

Filesize
423KB

MD5
7ed0cdc93b66eddf9964210348697da9

SHA1
5c7ac62be5290e6440ccf486d13a66aca5cc3624

SHA256
3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

SHA512
d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe

Filesize
221KB

MD5
f838a32461606e52471f5a9a0c692c6a

SHA1
af48a08ed1e6726eebec0f153f45f1666c86f575

SHA256
2f4538397e41e60af3017a1b44e10b931b429480e7120fc4e55759ef861f53fc

SHA512
0be2c1f3fcea992e4c3cf17fe38d4ef0d9b98928ee30a9d0bd0a9bbd6e6829a9b7aff5470e1a3a02a331fed528364de67af4199a7d267b235b5e23d99b9bfd06

Download Submit
memory/1876-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4940-23-0x0000000007B20000-0x00000000080C4000-memory.dmp

Filesize
5.6MB

Download
memory/4940-22-0x00000000008C0000-0x00000000008FE000-memory.dmp

Filesize
248KB

Download
memory/4940-24-0x0000000007650000-0x00000000076E2000-memory.dmp

Filesize
584KB

Download
memory/4940-25-0x0000000004C20000-0x0000000004C2A000-memory.dmp

Filesize
40KB

Download
memory/4940-26-0x00000000086F0000-0x0000000008D08000-memory.dmp

Filesize
6.1MB

Download
memory/4940-27-0x00000000080D0000-0x00000000081DA000-memory.dmp

Filesize
1.0MB

Download
memory/4940-28-0x0000000007770000-0x0000000007782000-memory.dmp

Filesize
72KB

Download
memory/4940-29-0x00000000077E0000-0x000000000781C000-memory.dmp

Filesize
240KB

Download
memory/4940-30-0x0000000007960000-0x00000000079AC000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads