mystic | 3cc30911c3eb32deaf5fb8bc4dfe2ca6abbafa106ab4c16e8ff25a715c1fe7e7

Analysis

max time kernel
149s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe
Size

417KB
MD5

29661c435e2a1539b16d18c8cf3e89e8
SHA1

f7b2baf441d7712466af4b2e5b421fac1cee810f
SHA256

227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb
SHA512

58431e6f238d97c73e19cea639f403a7fd53bc95f67586b443f28899f834a7f0f6f1e659cfc209c194ec1ad621c70ef451445458df71b5ec466bb4b5ce24270b
SSDEEP

6144:Kdy+bnr+gp0yN90QEGQk1IFT7XtSbixnWrMiO6Z3ry4cLclR07Chm6SsHOpi:zMroy90BUIFTVncMiFYSlRa2HNH

Score

10^/10

mystic redline gigant infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

gigant

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1088-7-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral2/memory/1088-11-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral2/memory/1088-8-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral2/memory/1088-9-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023276-13.dat	family_redline
behavioral2/memory/1180-16-0x0000000000760000-0x000000000079E000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
4348	1Vo98lN0.exe
1180	2ik789sN.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4348 set thread context of 1088	4348	1Vo98lN0.exe	93

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3912	1088	WerFault.exe	93
4736	4348	WerFault.exe	91

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4348	1260	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe	91
PID 1260 wrote to memory of 4348	1260	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe	91
PID 1260 wrote to memory of 4348	1260	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe	91
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 4348 wrote to memory of 1088	4348	1Vo98lN0.exe	93
PID 1260 wrote to memory of 1180	1260	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe	99
PID 1260 wrote to memory of 1180	1260	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe	99
PID 1260 wrote to memory of 1180	1260	227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe	99

C:\Users\Admin\AppData\Local\Temp\227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe
"C:\Users\Admin\AppData\Local\Temp\227ab56ef5937ce1494f5b0cd787a052c624e8a674162dba77f9c8d6aebfbceb.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Vo98lN0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Vo98lN0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1088
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 540
      4⤵
      Program crash
      PID:3912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4348 -s 616
    3⤵
    - Program crash
    PID:4736
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ik789sN.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ik789sN.exe
  2⤵
  - Executes dropped EXE
  PID:1180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4348 -ip 4348
1⤵
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1088 -ip 1088
1⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Vo98lN0.exe

Filesize
378KB

MD5
b8230c254efeecf37cf29bbe4c2cb810

SHA1
aedceaa17a7942199f9ab422bdaeccd685007afd

SHA256
b418563ad515b311300e10e9ffc495a259b5f5f6a059a4b9e5c28571c3945a0d

SHA512
243c986b70f4aa1c2e00e3afd2bfeeb94d087b7c694517a259e263becd20c03e6125040469f8f78741c384715f5bc398343b005cf823084a072baf395477e4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ik789sN.exe

Filesize
231KB

MD5
d6b3f00953ad41aecdeebc3f3e20599f

SHA1
c97dd7bdcfb2c350fe01652af40004dfd4e8d2d8

SHA256
b6b437a8c1cd07d29a55e57e7512d783b85f92b6e91e13bef2963419d2002779

SHA512
9a569a5e12f2fa4a4db15dcc688b6e307f104b081096d330e135f9dce8a6b9b6f4c11e1849e6b42c12ab92d70544f2498502f654d6502ac306eb66233a2de696

Download Submit
memory/1088-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1180-17-0x0000000007AA0000-0x0000000008044000-memory.dmp

Filesize
5.6MB

Download
memory/1180-16-0x0000000000760000-0x000000000079E000-memory.dmp

Filesize
248KB

Download
memory/1180-15-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/1180-18-0x0000000007590000-0x0000000007622000-memory.dmp

Filesize
584KB

Download
memory/1180-19-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download
memory/1180-20-0x0000000007550000-0x000000000755A000-memory.dmp

Filesize
40KB

Download
memory/1180-21-0x0000000008670000-0x0000000008C88000-memory.dmp

Filesize
6.1MB

Download
memory/1180-22-0x0000000008050000-0x000000000815A000-memory.dmp

Filesize
1.0MB

Download
memory/1180-23-0x0000000007910000-0x0000000007922000-memory.dmp

Filesize
72KB

Download
memory/1180-24-0x0000000007970000-0x00000000079AC000-memory.dmp

Filesize
240KB

Download
memory/1180-25-0x00000000079B0000-0x00000000079FC000-memory.dmp

Filesize
304KB

Download
memory/1180-26-0x00000000746AE000-0x00000000746AF000-memory.dmp

Filesize
4KB

Download
memory/1180-27-0x00000000746A0000-0x0000000074E50000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads