mystic | 3cc30911c3eb32deaf5fb8bc4dfe2ca6abbafa106ab4c16e8ff25a715c1fe7e7

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe
Size

382KB
MD5

6c3d6a9ec51ecc2a6a3d5a9c2dc110cf
SHA1

963481fb03f578599ae2a1f891e1c4e543e3f7f1
SHA256

d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1
SHA512

9d6089355195b763262cfe6085161829d7896fdba1ccd6fefe9ac0021f80154ca455151a322116b8a50e3fe84918991b2a136500006e0d0a773cc7a2cca246e9
SSDEEP

6144:Kyy+bnr+Up0yN90QElUJW+qa+JH06d1stdHzliEmcQPoLzk72b03tZcjtJRiJCU:2MrUy90PUAnpeKCXTliEmGzC2wc5riJ9

Score

10^/10

mystic redline kukish infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral14/memory/4592-7-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral14/memory/4592-8-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral14/memory/4592-11-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral14/memory/4592-9-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral14/files/0x0007000000023553-13.dat	family_redline
behavioral14/memory/4108-16-0x0000000000C00000-0x0000000000C3E000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
4924	1xr24Ve7.exe
4108	2uI359Rm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4924 set thread context of 4592	4924	1xr24Ve7.exe	92

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2704	4924	WerFault.exe	88
2816	4592	WerFault.exe	92

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 4924	1348	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe	88
PID 1348 wrote to memory of 4924	1348	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe	88
PID 1348 wrote to memory of 4924	1348	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe	88
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 4924 wrote to memory of 4592	4924	1xr24Ve7.exe	92
PID 1348 wrote to memory of 4108	1348	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe	98
PID 1348 wrote to memory of 4108	1348	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe	98
PID 1348 wrote to memory of 4108	1348	d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe	98

C:\Users\Admin\AppData\Local\Temp\d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe
"C:\Users\Admin\AppData\Local\Temp\d4278320848f0e71f678149e0b9ee4ecac3b5305400ae7d69a7131364d60cae1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1xr24Ve7.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1xr24Ve7.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 544
      4⤵
      Program crash
      PID:2816
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 584
    3⤵
    - Program crash
    PID:2704
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2uI359Rm.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2uI359Rm.exe
  2⤵
  - Executes dropped EXE
  PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4592 -ip 4592
1⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4924 -ip 4924
1⤵
PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1284,i,1697479186275492802,18058102846092193784,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1xr24Ve7.exe

Filesize
295KB

MD5
a497bb62320d2f81197cbc2bdf2e782f

SHA1
48c1b4a7c7e2a0879f63d23967425dd495fe63d2

SHA256
b01e9801a3cf03715f66130656ced8113730b53859bb634aea38a91659c0bfb2

SHA512
3e00987369850142af46c37a3cddde2960e84057dfcc82e41c86cf8f23cd4a83258e5b21994972c02c8ff79c653d32da192c2576ef62b9aa6a28abc2beb688be

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2uI359Rm.exe

Filesize
222KB

MD5
9eed4d2a0856f7249eb5446f5f20f3ff

SHA1
9da9f2e1021235d5b758123a8190e16ef53b1241

SHA256
a4770cbabeb920c86f9d7504bf5d1bbf0acc12026e1c67f69ecd53574373580c

SHA512
8a6423636d506448c7fc5fe65a10308ea94b13d6c9a53818cb335cc93289f322b4b36b4b692d52a5540e6b6c5ff6927d6bc0fa438037525aa31b4937522a6822

Download Submit
memory/4108-21-0x0000000008A90000-0x00000000090A8000-memory.dmp

Filesize
6.1MB

Download
memory/4108-20-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4108-27-0x00000000748E0000-0x0000000075090000-memory.dmp

Filesize
7.7MB

Download
memory/4108-26-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/4108-15-0x00000000748EE000-0x00000000748EF000-memory.dmp

Filesize
4KB

Download
memory/4108-16-0x0000000000C00000-0x0000000000C3E000-memory.dmp

Filesize
248KB

Download
memory/4108-17-0x0000000007EC0000-0x0000000008464000-memory.dmp

Filesize
5.6MB

Download
memory/4108-18-0x00000000079F0000-0x0000000007A82000-memory.dmp

Filesize
584KB

Download
memory/4108-19-0x0000000002F30000-0x0000000002F3A000-memory.dmp

Filesize
40KB

Download
memory/4108-25-0x0000000007C70000-0x0000000007CBC000-memory.dmp

Filesize
304KB

Download
memory/4108-24-0x0000000007C30000-0x0000000007C6C000-memory.dmp

Filesize
240KB

Download
memory/4108-22-0x0000000008470000-0x000000000857A000-memory.dmp

Filesize
1.0MB

Download
memory/4108-23-0x0000000007BA0000-0x0000000007BB2000-memory.dmp

Filesize
72KB

Download
memory/4592-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4592-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4592-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4592-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads