mystic | 9874024432d4a4dc4017d0ebf9773eaea78b9aea747dfbe995938af4b572eb38

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe
Size

960KB
MD5

434e0981e30d301a832a17e279104945
SHA1

f1aa4d85961747aa1ffd030a074e406ef37101be
SHA256

6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0
SHA512

02cc56eb6661599b6d670e4fcdf852c76bedc34c83dbd864b42494801eea6bc6c2ae12493112c27f93b2f9256c4ef8af0fa7ad0c03d27b4e244c7777d88af117
SSDEEP

12288:qMrDy90XE2JeSkUMBXNM1odv9TLauZxbiJsfPMoG1whZ87XQqHUrE1D5q/1GgfgX:9yexJeDB+oZFd+JsfUonZ8ZHBKI5aC

Score

10^/10

mystic redline smokeloader breha backdoor evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Extracted

Family

redline

Botnet

breha

77.91.124.55:19071

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral12/memory/2116-25-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral12/memory/2116-28-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral12/memory/2116-26-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral12/memory/4272-36-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 6 IoCs

pid	Process
3548	Yc7nH31.exe
4908	zx2VY19.exe
4884	1UX55by6.exe
728	2Al5841.exe
1404	3MK92QP.exe
3196	4pW805zC.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zx2VY19.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Yc7nH31.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4884 set thread context of 4312	4884	1UX55by6.exe	86
PID 728 set thread context of 2116	728	2Al5841.exe	94
PID 1404 set thread context of 3476	1404	3MK92QP.exe	98
PID 3196 set thread context of 4272	3196	4pW805zC.exe	102

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4212	4884	WerFault.exe	85
2220	728	WerFault.exe	92
4112	1404	WerFault.exe	97
2444	3196	WerFault.exe	101

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	AppLaunch.exe
4312	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	AppLaunch.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 3548	1516	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe	83
PID 1516 wrote to memory of 3548	1516	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe	83
PID 1516 wrote to memory of 3548	1516	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe	83
PID 3548 wrote to memory of 4908	3548	Yc7nH31.exe	84
PID 3548 wrote to memory of 4908	3548	Yc7nH31.exe	84
PID 3548 wrote to memory of 4908	3548	Yc7nH31.exe	84
PID 4908 wrote to memory of 4884	4908	zx2VY19.exe	85
PID 4908 wrote to memory of 4884	4908	zx2VY19.exe	85
PID 4908 wrote to memory of 4884	4908	zx2VY19.exe	85
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4884 wrote to memory of 4312	4884	1UX55by6.exe	86
PID 4908 wrote to memory of 728	4908	zx2VY19.exe	92
PID 4908 wrote to memory of 728	4908	zx2VY19.exe	92
PID 4908 wrote to memory of 728	4908	zx2VY19.exe	92
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 728 wrote to memory of 2116	728	2Al5841.exe	94
PID 3548 wrote to memory of 1404	3548	Yc7nH31.exe	97
PID 3548 wrote to memory of 1404	3548	Yc7nH31.exe	97
PID 3548 wrote to memory of 1404	3548	Yc7nH31.exe	97
PID 1404 wrote to memory of 3476	1404	3MK92QP.exe	98
PID 1404 wrote to memory of 3476	1404	3MK92QP.exe	98
PID 1404 wrote to memory of 3476	1404	3MK92QP.exe	98
PID 1404 wrote to memory of 3476	1404	3MK92QP.exe	98
PID 1404 wrote to memory of 3476	1404	3MK92QP.exe	98
PID 1404 wrote to memory of 3476	1404	3MK92QP.exe	98
PID 1516 wrote to memory of 3196	1516	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe	101
PID 1516 wrote to memory of 3196	1516	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe	101
PID 1516 wrote to memory of 3196	1516	6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe	101
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102
PID 3196 wrote to memory of 4272	3196	4pW805zC.exe	102

C:\Users\Admin\AppData\Local\Temp\6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe
"C:\Users\Admin\AppData\Local\Temp\6ff00efb56e1358cc67995d20e4e1edfffeb0789812a5cd830e2f477e16f63f0.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yc7nH31.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yc7nH31.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zx2VY19.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zx2VY19.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UX55by6.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UX55by6.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 600
        5⤵
        Program crash
        
        PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Al5841.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Al5841.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:728
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:2116
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 572
        5⤵
        Program crash
        
        PID:2220
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3MK92QP.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3MK92QP.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Checks SCSI registry key(s)
      PID:3476
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1404 -s 568
      4⤵
      Program crash
      PID:4112
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4pW805zC.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4pW805zC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3196 -s 572
    3⤵
    - Program crash
    PID:2444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4884 -ip 4884
1⤵
PID:4184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 728 -ip 728
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1404 -ip 1404
1⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3196 -ip 3196
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4pW805zC.exe

Filesize
486KB

MD5
314e9ac2292ad44e1763375c5e8c3d69

SHA1
31afb2af132fec502ba92f0701fc8236f635e95e

SHA256
54a6eeff0577fa7a11ce53417ce3109c41ccdd9eed6188fc4c35f603e18caf18

SHA512
0e01a50c3a045c1c7d770a91d156f57f37dd142c88512f1e8e89449106d8759a8fd011328a01584289ee87fb35685c2edfbd3b17d4e79e115d9f877ba8e54449

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yc7nH31.exe

Filesize
658KB

MD5
ab9bd79aada7aff18e6a4d4e47ea7f1b

SHA1
219b2363f804bea1f48f6968ffc587326e0e437c

SHA256
9f445b2fc94d083e9facaa8121cd3723b66d978b3556d4598e0e15b7339d6530

SHA512
dcc4331dc6c03deccb3c8820b6fc99f87afd13113ae48925c6400bf585963d13eb80b8c68b333cb966aed9622e5dad42d59a1aba0609b055d9717ace7cca1698

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3MK92QP.exe

Filesize
295KB

MD5
0068dedc017dbc1a4909c43585ef85cc

SHA1
98c0ace3797e9b82e9985a212a11ff1b5e222f59

SHA256
7b170cd436488e9dddfb4c4d49c2403739f4231bc159ca4a77d4c3ad9f63b1bd

SHA512
8177aa653fbf0fcaf6829d041effac244142cecfe334dffdd0184643869f55163f797e578c9612432dd3d141423de55cca51cd10689f5eef1120487f54feac08

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zx2VY19.exe

Filesize
407KB

MD5
925279a3e73b5e6270024ccc22e20455

SHA1
e935db224492c03f6ed49c54c84576d9aa18bf03

SHA256
c589e40bf545842a746b78deb6c4cd0b2b9b34f5841d44a80eb9782acfd71969

SHA512
06647fd945e399c83efcfb2c17123e076a49bbdd5a2e8ce9997da01486de83ea7ccc772b2dc0d28b1d2d9f0f684f21122fdd52c6f89ae521eee6f7dd3274099e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1UX55by6.exe

Filesize
276KB

MD5
8e22a35113710bfde1c6f071413c7ab8

SHA1
c8c7331630ddc672108fd49715847d4edd33488a

SHA256
0c07ebbf10ecddbecf1395f3ec32989d1156b71b011026f911fcb063e6494b03

SHA512
2a2d48c45e766f10fe0beafb737edf1debeeae857e69a5cb341762e22901767b304c6e1a8ecd351957762b43a0a05d4051a8b1f6284443bd53ca8e9ee9ed48e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Al5841.exe

Filesize
450KB

MD5
235fb90276a1f78b6d6251a291ab4ddc

SHA1
a9c58e266b41fe77f4360f9cf3a848776d0902ec

SHA256
e127f14498e59c5ef3b29b5353c148260096d11f021da05e9d9402bfeb4bf18a

SHA512
399b84e1b2aa15fc02b41f83afb97d70f62cb153d7254e71f8033f93f814520b390d55873d17ad763856f8a3ecfc2db84618145b52fcd15c37b627605aca9999

Download Submit
memory/2116-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2116-26-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2116-28-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3476-32-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4272-41-0x0000000007FC0000-0x00000000080CA000-memory.dmp

Filesize
1.0MB

Download
memory/4272-36-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4272-38-0x0000000007CA0000-0x0000000007D32000-memory.dmp

Filesize
584KB

Download
memory/4272-37-0x0000000008170000-0x0000000008714000-memory.dmp

Filesize
5.6MB

Download
memory/4272-39-0x0000000005160000-0x000000000516A000-memory.dmp

Filesize
40KB

Download
memory/4272-40-0x0000000008D40000-0x0000000009358000-memory.dmp

Filesize
6.1MB

Download
memory/4272-42-0x0000000007E50000-0x0000000007E62000-memory.dmp

Filesize
72KB

Download
memory/4272-43-0x0000000007EF0000-0x0000000007F2C000-memory.dmp

Filesize
240KB

Download
memory/4272-44-0x0000000007F30000-0x0000000007F7C000-memory.dmp

Filesize
304KB

Download
memory/4312-21-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download