mystic | 02cacf524527064e447c85bef406a6e5125d06b69bd35e10a813bf4a5659b985

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe
Size

956KB
MD5

c7d606e2c52cb54347c035c4f20385af
SHA1

fd14a9789a5cb3291a9fc9a21fc6a7011df32cfc
SHA256

3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3
SHA512

c3a07f6ef78ffdf38fee9613b451476e0c17aceebe9115bfd63c02350989197b15426fc854a3cc7a59878a3baa274c1a55b988374003389ee3ccbfa346ebce22
SSDEEP

24576:IyjahTARFOjnPlTRpSQ4Mh51NLlCTmBqqJj/vieOyO:P8TcIjnPlUOlwoqw3R

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral8/memory/548-25-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/548-28-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/548-26-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral8/memory/4588-36-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 6 IoCs

pid	Process
4444	Op9Fk77.exe
3160	rI7FK34.exe
3260	1Ff69WZ4.exe
4008	2mI8436.exe
408	3IW07tF.exe
2980	4zQ997RJ.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	rI7FK34.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Op9Fk77.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3260 set thread context of 116	3260	1Ff69WZ4.exe	86
PID 4008 set thread context of 548	4008	2mI8436.exe	94
PID 408 set thread context of 3412	408	3IW07tF.exe	98
PID 2980 set thread context of 4588	2980	4zQ997RJ.exe	102

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5116	sc.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1284	3260	WerFault.exe	84
4140	4008	WerFault.exe	93
4272	408	WerFault.exe	97
3600	2980	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
116	AppLaunch.exe
116	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	116	AppLaunch.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4444	3324	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe	82
PID 3324 wrote to memory of 4444	3324	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe	82
PID 3324 wrote to memory of 4444	3324	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe	82
PID 4444 wrote to memory of 3160	4444	Op9Fk77.exe	83
PID 4444 wrote to memory of 3160	4444	Op9Fk77.exe	83
PID 4444 wrote to memory of 3160	4444	Op9Fk77.exe	83
PID 3160 wrote to memory of 3260	3160	rI7FK34.exe	84
PID 3160 wrote to memory of 3260	3160	rI7FK34.exe	84
PID 3160 wrote to memory of 3260	3160	rI7FK34.exe	84
PID 3260 wrote to memory of 792	3260	1Ff69WZ4.exe	85
PID 3260 wrote to memory of 792	3260	1Ff69WZ4.exe	85
PID 3260 wrote to memory of 792	3260	1Ff69WZ4.exe	85
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3260 wrote to memory of 116	3260	1Ff69WZ4.exe	86
PID 3160 wrote to memory of 4008	3160	rI7FK34.exe	93
PID 3160 wrote to memory of 4008	3160	rI7FK34.exe	93
PID 3160 wrote to memory of 4008	3160	rI7FK34.exe	93
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4008 wrote to memory of 548	4008	2mI8436.exe	94
PID 4444 wrote to memory of 408	4444	Op9Fk77.exe	97
PID 4444 wrote to memory of 408	4444	Op9Fk77.exe	97
PID 4444 wrote to memory of 408	4444	Op9Fk77.exe	97
PID 408 wrote to memory of 3412	408	3IW07tF.exe	98
PID 408 wrote to memory of 3412	408	3IW07tF.exe	98
PID 408 wrote to memory of 3412	408	3IW07tF.exe	98
PID 408 wrote to memory of 3412	408	3IW07tF.exe	98
PID 408 wrote to memory of 3412	408	3IW07tF.exe	98
PID 408 wrote to memory of 3412	408	3IW07tF.exe	98
PID 3324 wrote to memory of 2980	3324	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe	101
PID 3324 wrote to memory of 2980	3324	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe	101
PID 3324 wrote to memory of 2980	3324	3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe	101
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102
PID 2980 wrote to memory of 4588	2980	4zQ997RJ.exe	102

C:\Users\Admin\AppData\Local\Temp\3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe
"C:\Users\Admin\AppData\Local\Temp\3ae8cc733ec108080a1919852f9eed660c71dff454329a044b21af12ce8fa4e3.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Op9Fk77.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Op9Fk77.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rI7FK34.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rI7FK34.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ff69WZ4.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ff69WZ4.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3260
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:792
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 608
        5⤵
        Program crash
        
        PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2mI8436.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2mI8436.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4008
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:548
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4008 -s 572
        5⤵
        Program crash
        
        PID:4140
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3IW07tF.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3IW07tF.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:408
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Checks SCSI registry key(s)
      PID:3412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 572
      4⤵
      Program crash
      PID:4272
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4zQ997RJ.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4zQ997RJ.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 572
    3⤵
    - Program crash
    PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3260 -ip 3260
1⤵
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4008 -ip 4008
1⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 408 -ip 408
1⤵
PID:2960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2980 -ip 2980
1⤵
PID:3724

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4zQ997RJ.exe

Filesize
486KB

MD5
00c781c1a5a925ca9bdcd6ad04ea2b06

SHA1
5f38e88beb9c393cea4baf891f315dab3861fa7d

SHA256
7f8b87d974c6c2d287aa2900b29835cfa76fcbff144aa6e74143152f3f2fe8d1

SHA512
46976b08ff464076492e837fa17a3c24611519671ef538a11f281236bf69bac715507637840113d9cd97f60cce33afc9b23aadf866717e121aa5dec9cae1d3d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Op9Fk77.exe

Filesize
654KB

MD5
06b98319424809f40aab2aa25a0eaa97

SHA1
29f5653c0c8ab96dfc5448dfa7905065e0b30eca

SHA256
bfe6775656ff4b278516ca6770f7e49cdee3e0634740689f1861860ee20ed7c5

SHA512
934a7379d9ad87c00a29ee0c217359e938488d7fba16e7cf0a21bbd8645b1eb7d7466afbaef6ddf03d41e8b1173ab014d08f53c0f34c6bcaf3cf748b8736763e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3IW07tF.exe

Filesize
294KB

MD5
7c2deede43e8c1956b006b1bba71e487

SHA1
0ce56c5e6b75ee49784b292eea1cde63848dc878

SHA256
25b116a8d53057ce4c2fd2ddc0ebb71b29a2a06ac6d8291fcc8c4a0a38bae5e1

SHA512
c4f9862a3ea8137efb4d7a3da054edb94981a0c7a262bcd9762801f642e0337a4f1c9657a5e3718bdd1c1a7a3168e93e128fe1704e62fa2f77cff69eaf294e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rI7FK34.exe

Filesize
403KB

MD5
5b0f6bb73b28259e867536399af3480c

SHA1
d10b298aeb766e21d47408fc73f505a7187cbf0c

SHA256
fbe4d3d9dd6925d40a98ede371080a34a3e68fef342f5c66f4d8eceaec5c342e

SHA512
eca50c7f7b38a83eed685669579714c568b9198860c2dd60ead8f039f81ed9a2b241b208e31e5829fe480557f23a12fc5030796750396f0fa6ea50f310362f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1Ff69WZ4.exe

Filesize
277KB

MD5
57b209441e027b6f046eb096af754dea

SHA1
c0ba339a2e2f0452f92504dc457ed0a13c75d60f

SHA256
17f767d30ed32e2a7cd42ac45ef3335bde326720e7b5a04c856a2cc3ab7076b8

SHA512
a93a70f7dc32d4416b392359df22da01fcc73ef84ff9484437dc6ef6d11b678abbeb7cfc4ae5b168823c44573b7ba112fc2ce3ae978240e558774cd2d738c86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2mI8436.exe

Filesize
450KB

MD5
d4be2c5b707bf8843e59188945b51203

SHA1
35f0cde80b5e04204700ca82e1d866e369d1949c

SHA256
8571095773c6e5ae684bb053bdc6822ab5bae4b212ccb29855d2380937a5a2fa

SHA512
e914c757ce1e0f8cc8409bcb85f302c26b2cd5277a22355b3116ad54ffdea8627b28b456bf5c857d5aee1c6034ca1269f9ec5c2620a92de557032beb3cee2190

Download Submit
memory/116-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/548-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3412-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4588-36-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4588-37-0x0000000007EE0000-0x0000000008484000-memory.dmp

Filesize
5.6MB

Download
memory/4588-38-0x0000000007A10000-0x0000000007AA2000-memory.dmp

Filesize
584KB

Download
memory/4588-39-0x0000000002E20000-0x0000000002E2A000-memory.dmp

Filesize
40KB

Download
memory/4588-40-0x0000000008AB0000-0x00000000090C8000-memory.dmp

Filesize
6.1MB

Download
memory/4588-41-0x0000000008490000-0x000000000859A000-memory.dmp

Filesize
1.0MB

Download
memory/4588-42-0x0000000007AE0000-0x0000000007AF2000-memory.dmp

Filesize
72KB

Download
memory/4588-43-0x0000000007B80000-0x0000000007BBC000-memory.dmp

Filesize
240KB

Download
memory/4588-44-0x0000000007B10000-0x0000000007B5C000-memory.dmp

Filesize
304KB

Download