mystic | 8824938b516f326c8fb474e2d13f12a648cbe7fc793dd565bd44ecc9fcbcec96

General

Target

6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe
Size

675KB
MD5

6fcbcc98ebbbe636a0fe0e54638c2620
SHA1

2d721ffb4b9dad939cd44b1723cbcb0af29cb8f1
SHA256

8824938b516f326c8fb474e2d13f12a648cbe7fc793dd565bd44ecc9fcbcec96
SHA512

74618716926b7f59431bd861eba3e3623d297db902e284ba14442cbebd1738cbe453e3c77cb5e67ca8fad4e2a92d5ede9e33542d39dcbb5af498b26966258fb8
SSDEEP

12288:/Mr1y90VQHlyKwme5SYAwaHeIDmb4yImOPsvIaHyqHBhRmux:6yHlyKwAzzmWshSqHR7x

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2584-7-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2584-11-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2584-9-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/2584-8-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe	family_redline
behavioral1/memory/3652-16-0x0000000000600000-0x000000000063E000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

Processes:

1TM96Rc3.exe2kK500If.exe

pid process

2736 1TM96Rc3.exe
3652 2kK500If.exe

pid	process
2736	1TM96Rc3.exe
3652	2kK500If.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

1TM96Rc3.exe

description pid process target process

PID 2736 set thread context of 2584 2736 1TM96Rc3.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3264 2584 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2736 set thread context of 2584	2736	1TM96Rc3.exe	AppLaunch.exe

pid	pid_target	process	target process
3264	2584	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe1TM96Rc3.exe

description	pid	process	target process
PID 4552 wrote to memory of 2736	4552	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	1TM96Rc3.exe
PID 4552 wrote to memory of 2736	4552	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	1TM96Rc3.exe
PID 4552 wrote to memory of 2736	4552	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	1TM96Rc3.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 2736 wrote to memory of 2584	2736	1TM96Rc3.exe	AppLaunch.exe
PID 4552 wrote to memory of 3652	4552	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	2kK500If.exe
PID 4552 wrote to memory of 3652	4552	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	2kK500If.exe
PID 4552 wrote to memory of 3652	4552	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	2kK500If.exe

C:\Users\Admin\AppData\Local\Temp\6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4552

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TM96Rc3.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TM96Rc3.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 540
4⤵
- Program crash
PID:3264

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe
2⤵
- Executes dropped EXE
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2584 -ip 2584
1⤵
PID:552

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TM96Rc3.exe
Filesize
1.8MB

MD5
55d3507f18e2f4b729e2d39b42ed30f7

SHA1
1e0e1f566dc8332c78ab12e7bd3228530e3f9a7d

SHA256
7a64de4e9ba61ab53f06e9ca11804a1855928bf2062ce7002f7942075fc9feae

SHA512
a546e95c790e6f0c7945b6f063107ce796bffd7bb1e3151820e9e1d50aeb5818ac56af8696dbae0c4042c96795f5ac178a6bf97517b10a94e6f945606c885afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe
Filesize
221KB

MD5
57bc3f29015a6cfa95e2ed5317bc58af

SHA1
1c9a0fb04acda54d5284c76373dc3c2408edd716

SHA256
7713f1b52bf485bbf1b02581551c90ccf137873a59655866e98e6ab1c0839c18

SHA512
e5a44d92f4aef9eb437fcb7b9758d211e43f4db07db7c6ae6ba200a581f7722baaf8e47d2775c547276d23f1a46557d30c90794e4044c0930b674889fabdaf2e

Download Submit
memory/2584-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2584-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2584-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2584-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3652-17-0x00000000078A0000-0x0000000007E44000-memory.dmp

Filesize
5.6MB

Download
memory/3652-16-0x0000000000600000-0x000000000063E000-memory.dmp

Filesize
248KB

Download
memory/3652-15-0x000000007415E000-0x000000007415F000-memory.dmp

Filesize
4KB

Download
memory/3652-18-0x00000000073D0000-0x0000000007462000-memory.dmp

Filesize
584KB

Download
memory/3652-19-0x0000000002870000-0x000000000287A000-memory.dmp

Filesize
40KB

Download
memory/3652-20-0x0000000074150000-0x0000000074900000-memory.dmp

Filesize
7.7MB

Download
memory/3652-21-0x0000000008470000-0x0000000008A88000-memory.dmp

Filesize
6.1MB

Download
memory/3652-22-0x0000000007790000-0x000000000789A000-memory.dmp

Filesize
1.0MB

Download
memory/3652-23-0x00000000074B0000-0x00000000074C2000-memory.dmp

Filesize
72KB

Download
memory/3652-24-0x0000000007540000-0x000000000757C000-memory.dmp

Filesize
240KB

Download
memory/3652-25-0x00000000074E0000-0x000000000752C000-memory.dmp

Filesize
304KB

Download
memory/3652-26-0x000000007415E000-0x000000007415F000-memory.dmp

Filesize
4KB

Download
memory/3652-27-0x0000000074150000-0x0000000074900000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads