mystic | 8824938b516f326c8fb474e2d13f12a648cbe7fc793dd565bd44ecc9fcbcec96

General

Target

6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe
Size

675KB
MD5

6fcbcc98ebbbe636a0fe0e54638c2620
SHA1

2d721ffb4b9dad939cd44b1723cbcb0af29cb8f1
SHA256

8824938b516f326c8fb474e2d13f12a648cbe7fc793dd565bd44ecc9fcbcec96
SHA512

74618716926b7f59431bd861eba3e3623d297db902e284ba14442cbebd1738cbe453e3c77cb5e67ca8fad4e2a92d5ede9e33542d39dcbb5af498b26966258fb8
SSDEEP

12288:/Mr1y90VQHlyKwme5SYAwaHeIDmb4yImOPsvIaHyqHBhRmux:6yHlyKwAzzmWshSqHR7x

Score

10^/10

mystic redline kinza infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kinza

C2

77.91.124.86:19084

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1924-7-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/1924-11-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/1924-8-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/1924-10-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023547-13.dat	family_redline
behavioral1/memory/4508-16-0x0000000000090000-0x00000000000CE000-memory.dmp	family_redline

Executes dropped EXE 2 IoCs

pid	Process
1008	1TM96Rc3.exe
4508	2kK500If.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1008 set thread context of 1924	1008	1TM96Rc3.exe	94

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4556	1924	WerFault.exe	94

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 1008	2916	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	90
PID 2916 wrote to memory of 1008	2916	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	90
PID 2916 wrote to memory of 1008	2916	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	90
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 1008 wrote to memory of 1924	1008	1TM96Rc3.exe	94
PID 2916 wrote to memory of 4508	2916	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	96
PID 2916 wrote to memory of 4508	2916	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	96
PID 2916 wrote to memory of 4508	2916	6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe	96

C:\Users\Admin\AppData\Local\Temp\6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\6fcbcc98ebbbe636a0fe0e54638c2620_NeikiAnalytics.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TM96Rc3.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TM96Rc3.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 540
      4⤵
      Program crash
      PID:4556
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe
  2⤵
  - Executes dropped EXE
  PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1924 -ip 1924
1⤵
PID:2800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4332,i,15721081447618313297,6839074028983272033,262144 --variations-seed-version --mojo-platform-channel-handle=1340 /prefetch:8
1⤵
PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1TM96Rc3.exe

Filesize
1.8MB

MD5
55d3507f18e2f4b729e2d39b42ed30f7

SHA1
1e0e1f566dc8332c78ab12e7bd3228530e3f9a7d

SHA256
7a64de4e9ba61ab53f06e9ca11804a1855928bf2062ce7002f7942075fc9feae

SHA512
a546e95c790e6f0c7945b6f063107ce796bffd7bb1e3151820e9e1d50aeb5818ac56af8696dbae0c4042c96795f5ac178a6bf97517b10a94e6f945606c885afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2kK500If.exe

Filesize
221KB

MD5
57bc3f29015a6cfa95e2ed5317bc58af

SHA1
1c9a0fb04acda54d5284c76373dc3c2408edd716

SHA256
7713f1b52bf485bbf1b02581551c90ccf137873a59655866e98e6ab1c0839c18

SHA512
e5a44d92f4aef9eb437fcb7b9758d211e43f4db07db7c6ae6ba200a581f7722baaf8e47d2775c547276d23f1a46557d30c90794e4044c0930b674889fabdaf2e

Download Submit
memory/1924-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1924-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1924-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1924-10-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4508-17-0x0000000007440000-0x00000000079E4000-memory.dmp

Filesize
5.6MB

Download
memory/4508-16-0x0000000000090000-0x00000000000CE000-memory.dmp

Filesize
248KB

Download
memory/4508-15-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/4508-18-0x0000000006F70000-0x0000000007002000-memory.dmp

Filesize
584KB

Download
memory/4508-19-0x0000000004560000-0x000000000456A000-memory.dmp

Filesize
40KB

Download
memory/4508-20-0x0000000073C40000-0x00000000743F0000-memory.dmp

Filesize
7.7MB

Download
memory/4508-21-0x0000000008010000-0x0000000008628000-memory.dmp

Filesize
6.1MB

Download
memory/4508-22-0x0000000007300000-0x000000000740A000-memory.dmp

Filesize
1.0MB

Download
memory/4508-23-0x0000000007080000-0x0000000007092000-memory.dmp

Filesize
72KB

Download
memory/4508-24-0x0000000007230000-0x000000000726C000-memory.dmp

Filesize
240KB

Download
memory/4508-25-0x0000000007270000-0x00000000072BC000-memory.dmp

Filesize
304KB

Download
memory/4508-26-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/4508-27-0x0000000073C40000-0x00000000743F0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads