mystic | cc5e37d73955fc0316a074c4b20f0296dee40952f8d275b2c6c6eb4eb0947059

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe
Size

921KB
MD5

7cf36789e46b4e994d0ec822dc83dc7d
SHA1

27d15125db1a5513c8ee55b640f548ce93778370
SHA256

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942
SHA512

0279d8e9d32a20dbcaf163a9a97a974273cfe42c55def0ec0b695046b0818732a31fae53bf32c7c97ef59532f2901ddf3f91ad52e390b0bf317243a2f6a9fd6d
SSDEEP

24576:Yyf0kXWxLoarfj5VYwLCo5Y0FAe9u0/C37qI/:ff0kCnrrgSL5Y0Oe9ukZI

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral9/memory/2196-21-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral9/memory/2196-25-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral9/memory/2196-24-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral9/memory/2196-22-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe	family_redline
behavioral9/memory/3504-29-0x0000000000830000-0x000000000086E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

Ke1Ls6aN.exeXY3bV4hC.exe1UE17UT2.exe2lu392Ig.exe

pid process

4032 Ke1Ls6aN.exe
3012 XY3bV4hC.exe
4860 1UE17UT2.exe
3504 2lu392Ig.exe

pid	process
4032	Ke1Ls6aN.exe
3012	XY3bV4hC.exe
4860	1UE17UT2.exe
3504	2lu392Ig.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exeKe1Ls6aN.exeXY3bV4hC.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ke1Ls6aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	XY3bV4hC.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1UE17UT2.exe

description pid process target process

PID 4860 set thread context of 2196 4860 1UE17UT2.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5108 4860 WerFault.exe 1UE17UT2.exe

description	pid	process	target process
PID 4860 set thread context of 2196	4860	1UE17UT2.exe	AppLaunch.exe

pid	pid_target	process	target process
5108	4860	WerFault.exe	1UE17UT2.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exeKe1Ls6aN.exeXY3bV4hC.exe1UE17UT2.exe

description	pid	process	target process
PID 3600 wrote to memory of 4032	3600	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe	Ke1Ls6aN.exe
PID 3600 wrote to memory of 4032	3600	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe	Ke1Ls6aN.exe
PID 3600 wrote to memory of 4032	3600	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe	Ke1Ls6aN.exe
PID 4032 wrote to memory of 3012	4032	Ke1Ls6aN.exe	XY3bV4hC.exe
PID 4032 wrote to memory of 3012	4032	Ke1Ls6aN.exe	XY3bV4hC.exe
PID 4032 wrote to memory of 3012	4032	Ke1Ls6aN.exe	XY3bV4hC.exe
PID 3012 wrote to memory of 4860	3012	XY3bV4hC.exe	1UE17UT2.exe
PID 3012 wrote to memory of 4860	3012	XY3bV4hC.exe	1UE17UT2.exe
PID 3012 wrote to memory of 4860	3012	XY3bV4hC.exe	1UE17UT2.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 4860 wrote to memory of 2196	4860	1UE17UT2.exe	AppLaunch.exe
PID 3012 wrote to memory of 3504	3012	XY3bV4hC.exe	2lu392Ig.exe
PID 3012 wrote to memory of 3504	3012	XY3bV4hC.exe	2lu392Ig.exe
PID 3012 wrote to memory of 3504	3012	XY3bV4hC.exe	2lu392Ig.exe

C:\Users\Admin\AppData\Local\Temp\74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe
"C:\Users\Admin\AppData\Local\Temp\74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1Ls6aN.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1Ls6aN.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XY3bV4hC.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XY3bV4hC.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UE17UT2.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UE17UT2.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4860
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2196
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4860 -s 148
        5⤵
        Program crash
        
        PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe
      4⤵
      Executes dropped EXE
      PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4860 -ip 4860
1⤵
PID:1280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4336,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
1⤵
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1Ls6aN.exe

Filesize
632KB

MD5
a50ad7225706a7d04491192ccb94c693

SHA1
20bbd7be562726c114cebef1de853f6578f34c76

SHA256
d60f7502e0aae6575b0c947c747b922d8ed3c3cba418791f7a870df47d54a56f

SHA512
66b351186d147e0411d07f054559262be59a657f18f5454d4edba2ae18db76535a464e137aecc36a9371a617d9ed66d08cf31ca2862faeffe8b473af83869889

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XY3bV4hC.exe

Filesize
436KB

MD5
d427fcba255f7c51253d6626b3e1189f

SHA1
f08ad71a3d5c49d3e7a189f47a2d71de3a140309

SHA256
ec5490ae4fe41aa8a5cf25e6442d9bd66d777a006ce0bd28067ff2509c59293a

SHA512
147ef1bd035ee61b7ff75aacd27f2e8ba287abab57df6c35d676371d95781d619b9d2881fde75719ce42c84571b269253d946d652c16f166d6a94575e8723947

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UE17UT2.exe

Filesize
407KB

MD5
58127032f567857936c882cd1370d5b5

SHA1
dc9a1d0a28e501712eac4beca8752ecbf367fdc2

SHA256
afae4d8645f69f6fc2db04f50ae2fcf5f0e5fdc6d274f2476832d2dd2ce31fdb

SHA512
0d0430438b7138312c197d74c05e31a181a4652e5db9eb64589860ddba0cb96530b6ea1c9dde35bae131eaa29bd290c9e276d28141e2d027fc3f78ca6b5f1eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe

Filesize
221KB

MD5
f261540b2c050efbdfca7320e08cbbb5

SHA1
363fe4a509c47a7174dadb2ed84fd24dbf336ba4

SHA256
ce99605f5e337ca89139f002bc77fe2361dcb43f59772ede383dcbd73e319dba

SHA512
b6ccafb8f3834a34fe1be6bb577d767292ed80b9964187b0791c41cc18f13bd2cbecec6c0b81e09c38519bf06925e957db3888d24dc15c1ec91f06bacf0eba87

Download Submit
memory/2196-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3504-29-0x0000000000830000-0x000000000086E000-memory.dmp

Filesize
248KB

Download
memory/3504-30-0x0000000007A90000-0x0000000008034000-memory.dmp

Filesize
5.6MB

Download
memory/3504-31-0x00000000075C0000-0x0000000007652000-memory.dmp

Filesize
584KB

Download
memory/3504-32-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Filesize
40KB

Download
memory/3504-33-0x0000000008660000-0x0000000008C78000-memory.dmp

Filesize
6.1MB

Download
memory/3504-34-0x0000000008040000-0x000000000814A000-memory.dmp

Filesize
1.0MB

Download
memory/3504-35-0x00000000076E0000-0x00000000076F2000-memory.dmp

Filesize
72KB

Download
memory/3504-36-0x0000000007750000-0x000000000778C000-memory.dmp

Filesize
240KB

Download
memory/3504-37-0x0000000007790000-0x00000000077DC000-memory.dmp

Filesize
304KB

Download