mystic | dcf4e78aa4f4a43375e6c66a708f11e84986bd1f7bacc1564324e028fcba76f4

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe
Size

764KB
MD5

aba2e6f1ae6d20b017b9362dde517f52
SHA1

99b4a3db453e1e559aac628607fa2cd749446144
SHA256

8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983
SHA512

77335886cc12be820fea5a46428835913dd9da761589652ea8ecc5084dcc391625f90b9412fc42c2f171e85d1b36f940f9089fb963173580bac96c907ddfddba
SSDEEP

12288:hMrJy90ZkO5d14gjHIO6mLRqUADkf5P4+9ApiJJjN2E6HFAOJZ29fy+k1:cyGtd1UQRqUAD45g+9TJJMLHWOJ89fTU

Score

10^/10

mystic redline kedru infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kedru

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral8/memory/5316-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/5316-16-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/5316-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral8/memory/5316-14-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral8/files/0x000700000002340b-21.dat	family_redline
behavioral8/memory/4376-22-0x0000000000FE0000-0x000000000101C000-memory.dmp	family_redline

Executes dropped EXE 3 IoCs

pid	Process
2448	NC9he9KB.exe
3052	1uo85FE1.exe
4376	2hZ332ON.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	NC9he9KB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3052 set thread context of 5316	3052	1uo85FE1.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2472	5316	WerFault.exe	86

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 2448	1140	8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe	82
PID 1140 wrote to memory of 2448	1140	8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe	82
PID 1140 wrote to memory of 2448	1140	8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe	82
PID 2448 wrote to memory of 3052	2448	NC9he9KB.exe	83
PID 2448 wrote to memory of 3052	2448	NC9he9KB.exe	83
PID 2448 wrote to memory of 3052	2448	NC9he9KB.exe	83
PID 3052 wrote to memory of 4220	3052	1uo85FE1.exe	85
PID 3052 wrote to memory of 4220	3052	1uo85FE1.exe	85
PID 3052 wrote to memory of 4220	3052	1uo85FE1.exe	85
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 3052 wrote to memory of 5316	3052	1uo85FE1.exe	86
PID 2448 wrote to memory of 4376	2448	NC9he9KB.exe	87
PID 2448 wrote to memory of 4376	2448	NC9he9KB.exe	87
PID 2448 wrote to memory of 4376	2448	NC9he9KB.exe	87

C:\Users\Admin\AppData\Local\Temp\8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe
"C:\Users\Admin\AppData\Local\Temp\8e3b7e61aa74a089a79cac60eb4ab68e048ad684cd4c79b7d000b22321106983.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NC9he9KB.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NC9he9KB.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uo85FE1.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uo85FE1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4220
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 192
        5⤵
        Program crash
        
        PID:2472
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2hZ332ON.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2hZ332ON.exe
    3⤵
    - Executes dropped EXE
    PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5316 -ip 5316
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\NC9he9KB.exe

Filesize
569KB

MD5
65397d5a452f62971084449feeaa8571

SHA1
4a3df0dfcabaf046bbad70cf7d21c1f8e5447033

SHA256
607fca3121d2af2fc0c2977efcd26c09ab1e53bd8ecbed8cf2834254e73a052a

SHA512
88e14d2ae3e793e30fb6bc1aff87eb7d1e3b872ac4e8f2ecdaed3ee00d1526b32bad3b1d6323c06b89b1cf9c5760749c2efc6e7adde4f275dedbcc7a80f854f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1uo85FE1.exe

Filesize
1.1MB

MD5
7dbae9e06c91312a169a2b51e13ee77c

SHA1
dae72a1c820cc81d055ce56cc26e23454d7c30fe

SHA256
d29302db08ff8d21f7d7205c14821dd09f2e5beb7aafdfb79baf17c376a57432

SHA512
6f360b5844f48bd314bc939d9acaf75493b155d62a204462503799d87809fd2eaf1d1773d0662063e0be0f27adade629f3e7e2782358cf8482aedcbe07cf6b6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2hZ332ON.exe

Filesize
219KB

MD5
ba630cf837433612136ee2a8e8d10f66

SHA1
8c8bc69b08a101ae470b6db75b7b5df9c25ba530

SHA256
1c653d0c4393edcb96cc24ca60800915bdfd02fcb4d0a184f35e285481154f4a

SHA512
c66521cbbdcae841c9e814f9c2fcd46494067e8215a7499e195588d937e5dcb804856fbe2c2b72827c243e000fa4ea2799f48be341228d3833232aba66d38352

Download Submit
memory/4376-27-0x0000000008110000-0x000000000821A000-memory.dmp

Filesize
1.0MB

Download
memory/4376-22-0x0000000000FE0000-0x000000000101C000-memory.dmp

Filesize
240KB

Download
memory/4376-23-0x0000000008290000-0x0000000008834000-memory.dmp

Filesize
5.6MB

Download
memory/4376-24-0x0000000007D80000-0x0000000007E12000-memory.dmp

Filesize
584KB

Download
memory/4376-25-0x00000000032E0000-0x00000000032EA000-memory.dmp

Filesize
40KB

Download
memory/4376-26-0x0000000008E60000-0x0000000009478000-memory.dmp

Filesize
6.1MB

Download
memory/4376-28-0x0000000007E90000-0x0000000007EA2000-memory.dmp

Filesize
72KB

Download
memory/4376-29-0x0000000008000000-0x000000000803C000-memory.dmp

Filesize
240KB

Download
memory/4376-30-0x0000000008040000-0x000000000808C000-memory.dmp

Filesize
304KB

Download
memory/5316-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5316-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5316-14-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5316-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads