mystic | 3767bd9b929fb47ae3b158c424044d32b3c87ffb6efc8eb109dc1df9f3d9b053

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe
Size

811KB
MD5

6d8683aa618e42dedaa0b1481f2beef5
SHA1

28989953e99c68e658d9667df1be4868a67c6539
SHA256

54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590
SHA512

426fb085dce3294ab7959ef052c3d2670d5a1801c2e8270d307ae641db2e5ffb99a9f3a8f1ae527badd3002084e1aaa28cdf4758ca79a92625859d54f1a4873d
SSDEEP

12288:XMrsy90DcFSGxIWNbwOvC498Kv2h+sMT/kV03itewXTGkjlxBDdmzMuQL:DyacvIWhTvC4lvPYVE8XqCxBBmdQL

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral8/memory/3372-23-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral8/memory/3372-25-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral8/memory/3372-22-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral8/memory/3372-21-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BF796Js.exe	family_redline
behavioral8/memory/3440-29-0x00000000004F0000-0x000000000052E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

an6bD9Xx.exeWi0Kp8Oz.exe1CM30ma5.exe2BF796Js.exe

pid process

1104 an6bD9Xx.exe
2268 Wi0Kp8Oz.exe
408 1CM30ma5.exe
3440 2BF796Js.exe

pid	process
1104	an6bD9Xx.exe
2268	Wi0Kp8Oz.exe
408	1CM30ma5.exe
3440	2BF796Js.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exean6bD9Xx.exeWi0Kp8Oz.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	an6bD9Xx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Wi0Kp8Oz.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1CM30ma5.exe

description pid process target process

PID 408 set thread context of 3372 408 1CM30ma5.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5040 408 WerFault.exe 1CM30ma5.exe

description	pid	process	target process
PID 408 set thread context of 3372	408	1CM30ma5.exe	AppLaunch.exe

pid	pid_target	process	target process
5040	408	WerFault.exe	1CM30ma5.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exean6bD9Xx.exeWi0Kp8Oz.exe1CM30ma5.exe

description	pid	process	target process
PID 4744 wrote to memory of 1104	4744	54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe	an6bD9Xx.exe
PID 4744 wrote to memory of 1104	4744	54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe	an6bD9Xx.exe
PID 4744 wrote to memory of 1104	4744	54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe	an6bD9Xx.exe
PID 1104 wrote to memory of 2268	1104	an6bD9Xx.exe	Wi0Kp8Oz.exe
PID 1104 wrote to memory of 2268	1104	an6bD9Xx.exe	Wi0Kp8Oz.exe
PID 1104 wrote to memory of 2268	1104	an6bD9Xx.exe	Wi0Kp8Oz.exe
PID 2268 wrote to memory of 408	2268	Wi0Kp8Oz.exe	1CM30ma5.exe
PID 2268 wrote to memory of 408	2268	Wi0Kp8Oz.exe	1CM30ma5.exe
PID 2268 wrote to memory of 408	2268	Wi0Kp8Oz.exe	1CM30ma5.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 408 wrote to memory of 3372	408	1CM30ma5.exe	AppLaunch.exe
PID 2268 wrote to memory of 3440	2268	Wi0Kp8Oz.exe	2BF796Js.exe
PID 2268 wrote to memory of 3440	2268	Wi0Kp8Oz.exe	2BF796Js.exe
PID 2268 wrote to memory of 3440	2268	Wi0Kp8Oz.exe	2BF796Js.exe

C:\Users\Admin\AppData\Local\Temp\54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe
"C:\Users\Admin\AppData\Local\Temp\54a187adfc33710db0fd5acd2d87f491717cf1110b0efa415680e544e43fd590.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4744

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\an6bD9Xx.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\an6bD9Xx.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Wi0Kp8Oz.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Wi0Kp8Oz.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2268

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1CM30ma5.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1CM30ma5.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 584
5⤵
- Program crash
PID:5040

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BF796Js.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BF796Js.exe
4⤵
- Executes dropped EXE
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 408 -ip 408
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\an6bD9Xx.exe

Filesize
577KB

MD5
59b9186fa791d7eebf67238b58bd2d4d

SHA1
0677ae571864a2e16ba0c3ca59f9e7c7d616a50f

SHA256
c826165bec00ecda5bbaabd6e9245050bd3bb2882d578ebc1d75c54596381e19

SHA512
f8800bfa4a88bb2e090832cf72a27b9c287701487f69344f1a07b1103545d7ac610c03e86dcc1e1d2d6aaebbd2be0a4cf32b5def20e6d84ee60c4d55efc5f8a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Wi0Kp8Oz.exe

Filesize
382KB

MD5
0cdd1d630baea001d0bad7a95db25072

SHA1
f4360bae0c4b6609c534eba13aafeaab3a492e54

SHA256
5eee268a879c07625d7394a82b7c1c9212c1bd08e2f22fd5b294cc02b2f31cc9

SHA512
2a6d327e07511fa00ed5c440afb2730a61384064ecb974c4ac895062bed87e1fe4388fbc0b9ddb633154827289c599949722aa4517f5fd6fc90854b4071d2cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1CM30ma5.exe

Filesize
295KB

MD5
66bdfee4ef9b26ed8d161e91fa32f4df

SHA1
65eea13abd7ec89f194c9703a4926de748324c38

SHA256
a40eddbeaf64736815cc75ee9b3a6cb785c5474dd31309cb48d485a23e2ca32c

SHA512
fe6b94a2cedb51a1cfaca580a3313cbe360cffa62da7d9607eda2279c1c3ec3af73b4caa7acf6723721babca5beb6948f329f76921776a2abeaa589fab3ebce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2BF796Js.exe

Filesize
222KB

MD5
8c5c774f027edfb3ca14b6ebfadbd343

SHA1
bd62bad4fc670b766d2f3c8800f56234db36d41b

SHA256
d57a78b2ceaf813b65e4e8ea532639345061fce101347d9317c001d659f9e133

SHA512
cf6d57edf8fa395b82a9561baae44d981d46f751986608912cf8acba152679c76f53f1ec107c82df05dbdeccec4264dc2d3b56c5226b0117ac044ac62d9a0ef2

Download Submit
memory/3372-23-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3372-25-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3372-22-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3372-21-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3440-29-0x00000000004F0000-0x000000000052E000-memory.dmp

Filesize
248KB

Download
memory/3440-30-0x00000000077F0000-0x0000000007D94000-memory.dmp

Filesize
5.6MB

Download
memory/3440-31-0x00000000072E0000-0x0000000007372000-memory.dmp

Filesize
584KB

Download
memory/3440-32-0x0000000000C60000-0x0000000000C6A000-memory.dmp

Filesize
40KB

Download
memory/3440-33-0x00000000083C0000-0x00000000089D8000-memory.dmp

Filesize
6.1MB

Download
memory/3440-34-0x0000000007610000-0x000000000771A000-memory.dmp

Filesize
1.0MB

Download
memory/3440-35-0x00000000074A0000-0x00000000074B2000-memory.dmp

Filesize
72KB

Download
memory/3440-36-0x0000000007540000-0x000000000757C000-memory.dmp

Filesize
240KB

Download
memory/3440-37-0x0000000007580000-0x00000000075CC000-memory.dmp

Filesize
304KB

Download