mystic | ce9955c91d6a5f9e211ecb80cc51d8025eccfe4e1398947c094c94a6e2904f18

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe
Size

640KB
MD5

83f05c5fda15836298e46fb4040f4c38
SHA1

63f0e9906de5027985d0bb31866535610e7da4d9
SHA256

3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7
SHA512

d47fff8e77915d9289f57b3768d82722ce888b2a11548ef6f83661729d56fbc2ac3128760d9a363c405ba0092d8c2713e8826df45d0d6b73dd125beeb6f80e9b
SSDEEP

12288:bMruy90Kr3s8LlcWABrlcjhrCWarqi8b+RdCGo6VE8+sjVyUQT:5ydc8LmBhIrzarqq06VEIyUo

Score

10^/10

mystic redline lutyr infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

lutyr

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral5/memory/4948-14-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral5/memory/4948-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral5/memory/4948-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral5/memory/4948-16-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe	family_redline
behavioral5/memory/3884-22-0x00000000007E0000-0x000000000081E000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

Processes:

Ju2HW2iO.exe1Td93Hj8.exe2rA713vi.exe

pid process

4316 Ju2HW2iO.exe
5020 1Td93Hj8.exe
3884 2rA713vi.exe

pid	process
4316	Ju2HW2iO.exe
5020	1Td93Hj8.exe
3884	2rA713vi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Ju2HW2iO.exe3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ju2HW2iO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1Td93Hj8.exe

description pid process target process

PID 5020 set thread context of 4948 5020 1Td93Hj8.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4568 5020 WerFault.exe 1Td93Hj8.exe
4680 4948 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 5020 set thread context of 4948	5020	1Td93Hj8.exe	AppLaunch.exe

pid	pid_target	process	target process
4568	5020	WerFault.exe	1Td93Hj8.exe
4680	4948	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exeJu2HW2iO.exe1Td93Hj8.exe

description	pid	process	target process
PID 4984 wrote to memory of 4316	4984	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe	Ju2HW2iO.exe
PID 4984 wrote to memory of 4316	4984	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe	Ju2HW2iO.exe
PID 4984 wrote to memory of 4316	4984	3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe	Ju2HW2iO.exe
PID 4316 wrote to memory of 5020	4316	Ju2HW2iO.exe	1Td93Hj8.exe
PID 4316 wrote to memory of 5020	4316	Ju2HW2iO.exe	1Td93Hj8.exe
PID 4316 wrote to memory of 5020	4316	Ju2HW2iO.exe	1Td93Hj8.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 5020 wrote to memory of 4948	5020	1Td93Hj8.exe	AppLaunch.exe
PID 4316 wrote to memory of 3884	4316	Ju2HW2iO.exe	2rA713vi.exe
PID 4316 wrote to memory of 3884	4316	Ju2HW2iO.exe	2rA713vi.exe
PID 4316 wrote to memory of 3884	4316	Ju2HW2iO.exe	2rA713vi.exe

C:\Users\Admin\AppData\Local\Temp\3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe
"C:\Users\Admin\AppData\Local\Temp\3d64fae31acb5d4e6e0319606608e94d2b3a017279c295dba43ce4d28aab53d7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4984

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ju2HW2iO.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ju2HW2iO.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Td93Hj8.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Td93Hj8.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
4⤵
PID:4948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 540
5⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 576
4⤵
- Program crash
PID:4568

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe
3⤵
- Executes dropped EXE
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4948 -ip 4948
1⤵
PID:384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5020 -ip 5020
1⤵
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ju2HW2iO.exe
Filesize
444KB

MD5
6b0e2c47872270341bd987ec04450b99

SHA1
da15aec4c4485cd3deda467b444c893f5e6c9616

SHA256
d29391ba6b121949ab4ca495bbb860cc0499d0b15a4093d67f9465d96b46e38e

SHA512
b1970fe9883ccabe0574839f7934adcec02465680af6464b62476ee46518ed101ea0e001574280525b55fc73fcca4abaa1bcadd09698533a7ee270449bb67a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Td93Hj8.exe
Filesize
423KB

MD5
7ed0cdc93b66eddf9964210348697da9

SHA1
5c7ac62be5290e6440ccf486d13a66aca5cc3624

SHA256
3283ee47aae3596704564d912a08365401af72d39083428e537e16b57e79e0da

SHA512
d2318ece279c4680e01750855b806b56d15ca6c7b4fc1642027cda2330800d36dfeb9681cf2b43f408b9010aa6ce8a96602c41982d0bc4fe5e76608d694f4085

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2rA713vi.exe
Filesize
221KB

MD5
f838a32461606e52471f5a9a0c692c6a

SHA1
af48a08ed1e6726eebec0f153f45f1666c86f575

SHA256
2f4538397e41e60af3017a1b44e10b931b429480e7120fc4e55759ef861f53fc

SHA512
0be2c1f3fcea992e4c3cf17fe38d4ef0d9b98928ee30a9d0bd0a9bbd6e6829a9b7aff5470e1a3a02a331fed528364de67af4199a7d267b235b5e23d99b9bfd06

Download Submit
memory/3884-27-0x0000000007930000-0x0000000007A3A000-memory.dmp

Filesize
1.0MB

Download
memory/3884-22-0x00000000007E0000-0x000000000081E000-memory.dmp

Filesize
248KB

Download
memory/3884-23-0x0000000007AB0000-0x0000000008054000-memory.dmp

Filesize
5.6MB

Download
memory/3884-24-0x00000000075A0000-0x0000000007632000-memory.dmp

Filesize
584KB

Download
memory/3884-25-0x0000000004B20000-0x0000000004B2A000-memory.dmp

Filesize
40KB

Download
memory/3884-26-0x0000000008680000-0x0000000008C98000-memory.dmp

Filesize
6.1MB

Download
memory/3884-28-0x0000000007790000-0x00000000077A2000-memory.dmp

Filesize
72KB

Download
memory/3884-29-0x0000000007820000-0x000000000785C000-memory.dmp

Filesize
240KB

Download
memory/3884-30-0x00000000077C0000-0x000000000780C000-memory.dmp

Filesize
304KB

Download
memory/4948-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download