mystic | ce9955c91d6a5f9e211ecb80cc51d8025eccfe4e1398947c094c94a6e2904f18

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe
Size

921KB
MD5

7cf36789e46b4e994d0ec822dc83dc7d
SHA1

27d15125db1a5513c8ee55b640f548ce93778370
SHA256

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942
SHA512

0279d8e9d32a20dbcaf163a9a97a974273cfe42c55def0ec0b695046b0818732a31fae53bf32c7c97ef59532f2901ddf3f91ad52e390b0bf317243a2f6a9fd6d
SSDEEP

24576:Yyf0kXWxLoarfj5VYwLCo5Y0FAe9u0/C37qI/:ff0kCnrrgSL5Y0Oe9ukZI

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral8/memory/1732-21-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/1732-23-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/1732-22-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/1732-25-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe	family_redline
behavioral8/memory/4040-29-0x0000000000E50000-0x0000000000E8E000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

Processes:

Ke1Ls6aN.exeXY3bV4hC.exe1UE17UT2.exe2lu392Ig.exe

pid process

1000 Ke1Ls6aN.exe
2056 XY3bV4hC.exe
4656 1UE17UT2.exe
4040 2lu392Ig.exe

pid	process
1000	Ke1Ls6aN.exe
2056	XY3bV4hC.exe
4656	1UE17UT2.exe
4040	2lu392Ig.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Ke1Ls6aN.exeXY3bV4hC.exe74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ke1Ls6aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	XY3bV4hC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1UE17UT2.exe

description pid process target process

PID 4656 set thread context of 1732 4656 1UE17UT2.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4868 4656 WerFault.exe 1UE17UT2.exe

description	pid	process	target process
PID 4656 set thread context of 1732	4656	1UE17UT2.exe	AppLaunch.exe

pid	pid_target	process	target process
4868	4656	WerFault.exe	1UE17UT2.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exeKe1Ls6aN.exeXY3bV4hC.exe1UE17UT2.exe

description	pid	process	target process
PID 4920 wrote to memory of 1000	4920	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe	Ke1Ls6aN.exe
PID 4920 wrote to memory of 1000	4920	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe	Ke1Ls6aN.exe
PID 4920 wrote to memory of 1000	4920	74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe	Ke1Ls6aN.exe
PID 1000 wrote to memory of 2056	1000	Ke1Ls6aN.exe	XY3bV4hC.exe
PID 1000 wrote to memory of 2056	1000	Ke1Ls6aN.exe	XY3bV4hC.exe
PID 1000 wrote to memory of 2056	1000	Ke1Ls6aN.exe	XY3bV4hC.exe
PID 2056 wrote to memory of 4656	2056	XY3bV4hC.exe	1UE17UT2.exe
PID 2056 wrote to memory of 4656	2056	XY3bV4hC.exe	1UE17UT2.exe
PID 2056 wrote to memory of 4656	2056	XY3bV4hC.exe	1UE17UT2.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 4656 wrote to memory of 1732	4656	1UE17UT2.exe	AppLaunch.exe
PID 2056 wrote to memory of 4040	2056	XY3bV4hC.exe	2lu392Ig.exe
PID 2056 wrote to memory of 4040	2056	XY3bV4hC.exe	2lu392Ig.exe
PID 2056 wrote to memory of 4040	2056	XY3bV4hC.exe	2lu392Ig.exe

C:\Users\Admin\AppData\Local\Temp\74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe
"C:\Users\Admin\AppData\Local\Temp\74c99e0dfdc0750268c34c3d63288e0bea52796a82c9b157a495fbe2608d4942.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4920

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1Ls6aN.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1Ls6aN.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1000

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XY3bV4hC.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XY3bV4hC.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2056

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UE17UT2.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UE17UT2.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
5⤵
PID:1732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 140
5⤵
- Program crash
PID:4868

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe
4⤵
- Executes dropped EXE
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4656 -ip 4656
1⤵
PID:4808

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ke1Ls6aN.exe
Filesize
632KB

MD5
a50ad7225706a7d04491192ccb94c693

SHA1
20bbd7be562726c114cebef1de853f6578f34c76

SHA256
d60f7502e0aae6575b0c947c747b922d8ed3c3cba418791f7a870df47d54a56f

SHA512
66b351186d147e0411d07f054559262be59a657f18f5454d4edba2ae18db76535a464e137aecc36a9371a617d9ed66d08cf31ca2862faeffe8b473af83869889

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\XY3bV4hC.exe
Filesize
436KB

MD5
d427fcba255f7c51253d6626b3e1189f

SHA1
f08ad71a3d5c49d3e7a189f47a2d71de3a140309

SHA256
ec5490ae4fe41aa8a5cf25e6442d9bd66d777a006ce0bd28067ff2509c59293a

SHA512
147ef1bd035ee61b7ff75aacd27f2e8ba287abab57df6c35d676371d95781d619b9d2881fde75719ce42c84571b269253d946d652c16f166d6a94575e8723947

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UE17UT2.exe
Filesize
407KB

MD5
58127032f567857936c882cd1370d5b5

SHA1
dc9a1d0a28e501712eac4beca8752ecbf367fdc2

SHA256
afae4d8645f69f6fc2db04f50ae2fcf5f0e5fdc6d274f2476832d2dd2ce31fdb

SHA512
0d0430438b7138312c197d74c05e31a181a4652e5db9eb64589860ddba0cb96530b6ea1c9dde35bae131eaa29bd290c9e276d28141e2d027fc3f78ca6b5f1eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2lu392Ig.exe
Filesize
221KB

MD5
f261540b2c050efbdfca7320e08cbbb5

SHA1
363fe4a509c47a7174dadb2ed84fd24dbf336ba4

SHA256
ce99605f5e337ca89139f002bc77fe2361dcb43f59772ede383dcbd73e319dba

SHA512
b6ccafb8f3834a34fe1be6bb577d767292ed80b9964187b0791c41cc18f13bd2cbecec6c0b81e09c38519bf06925e957db3888d24dc15c1ec91f06bacf0eba87

Download Submit
memory/1732-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-23-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4040-29-0x0000000000E50000-0x0000000000E8E000-memory.dmp

Filesize
248KB

Download
memory/4040-30-0x0000000008210000-0x00000000087B4000-memory.dmp

Filesize
5.6MB

Download
memory/4040-31-0x0000000007C60000-0x0000000007CF2000-memory.dmp

Filesize
584KB

Download
memory/4040-32-0x0000000005280000-0x000000000528A000-memory.dmp

Filesize
40KB

Download
memory/4040-33-0x0000000008DE0000-0x00000000093F8000-memory.dmp

Filesize
6.1MB

Download
memory/4040-34-0x0000000007F60000-0x000000000806A000-memory.dmp

Filesize
1.0MB

Download
memory/4040-35-0x0000000007E10000-0x0000000007E22000-memory.dmp

Filesize
72KB

Download
memory/4040-36-0x0000000007E90000-0x0000000007ECC000-memory.dmp

Filesize
240KB

Download
memory/4040-37-0x0000000007ED0000-0x0000000007F1C000-memory.dmp

Filesize
304KB

Download