mystic | 99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.exe
Size 1.5MB
Sample260922-lldydsshme
SHA256 99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e
MD5 d5b1f4584f629cdd85dfa6873d1c1e4f
SHA1 e4dcec5fa7bd2c6181a47d99acfa27c43033ba08
SHA512 0e02d1af6ce4aebe53093f3ec62ac813e4225a3667293e150c48bbadf72bc816ecc17bf0914337a0e3d4873f3f0a953a6a43ba5f7942549b37dc2aca0a353455
SSDEEP 24576:cy2iUHbLxfQMyCDCyUpwjoDMlFxqgFTvjSOZoN8qsCanWKDUo3+NdirX:LqxflapwjoonxntugoN8LlDUo8a
TLSH
T1F3752306ABF96113FE7243718DB216971A35B9E428B8475726252ADB8D723C4F4303EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

kukish discovery mystic redline infostealer persistence stealer

Malware Config

Extracted

Family

redline

Botnet

kukish

77.91.124.55:19071

Signatures

Family: Mystic
Mystic is an infostealer written in C++.
stealer mystic
Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral1/memory/644-35-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/644-38-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral1/memory/644-36-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

RedLine payload 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243a6-40.dat	family_redline
behavioral1/memory/2488-42-0x0000000000BF0000-0x0000000000C2E000-memory.dmp	family_redline

Executes dropped EXE 6 IoCs

pid	Process
1268	sh6EI4jy.exe
2068	Rz9gN1BB.exe
4912	Th8ab8zY.exe
2060	rP3vg1ix.exe
4320	1sq51Rw0.exe
2488	2RX132bB.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	sh6EI4jy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Rz9gN1BB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Th8ab8zY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	rP3vg1ix.exe

ConfuserEx .NET packer 1 IoCs

Detects ConfuserEx .NET packer.

resource	yara_rule
behavioral1/files/0x00070000000243a6-40.dat	ConfuserEx

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4320 set thread context of 644	4320	1sq51Rw0.exe	101

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sh6EI4jy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Th8ab8zY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rP3vg1ix.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1sq51Rw0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2RX132bB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rz9gN1BB.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 1268	4776	jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.exe	87
PID 1268 wrote to memory of 2068	1268	sh6EI4jy.exe	88
PID 2068 wrote to memory of 4912	2068	Rz9gN1BB.exe	90
PID 4912 wrote to memory of 2060	4912	Th8ab8zY.exe	91
PID 2060 wrote to memory of 4320	2060	rP3vg1ix.exe	93
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 4320 wrote to memory of 644	4320	1sq51Rw0.exe	101
PID 2060 wrote to memory of 2488	2060	rP3vg1ix.exe	102

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_99c869a06958ed674d6802e5e8d54236516ba9ba406447bc5730781aebd46e5e.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sh6EI4jy.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sh6EI4jy.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rz9gN1BB.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rz9gN1BB.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Th8ab8zY.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Th8ab8zY.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rP3vg1ix.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rP3vg1ix.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2060
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sq51Rw0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sq51Rw0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:644
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RX132bB.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RX132bB.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sh6EI4jy.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sh6EI4jy.exe
Size 1.4MB
SHA256 968e6df56a9fecdc784f105ed1531576a54aad98c7f293a59810ba01ab472252
MD5 bbc8f98a8dce4dbf76a05dc8b0251091
SHA1 58fb67ada21ac48db72569db3225dccd01f245f2
SHA512 99ce6572c400af0b1902f31ec76b0b2e84badf27b82b6b3042f8e51f5a17c0a76ec04ab4fe94fd53427a23385cb038c487ed6047955c95474487b3d321f1fc3c
SSDEEP 24576:vyHlFQ9Uf/CmVpGKuDMEFy+gwv3JVdZX1Frs9a/WNxCMKEK3+edi6:6FFJHrpGKu42y7gvnX1FzGBKJD
TLSH
T16B6523096FF96523FD7257724DF201930A30BDE429B84727262969AB4DB33C5E4703AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rz9gN1BB.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Rz9gN1BB.exe
Size 1.2MB
SHA256 216a15f05c03ec5b0e49cb59fa0a60bd7eb801dbb5b16b4ed4be3662e6d1df8c
MD5 93bb93b25c76bc40e9dfb827ed3c5f86
SHA1 1b36e7a8e4730811b69a24620c738402ef03b036
SHA512 cc2c2756af44fd8d02f259a8533cb2ed00ea73b4363b088b458971711031cfa1560fc5b082032343e89b9c2b6d7ac5263d6c8fb2314bb89700cba6a5a5e22f25
SSDEEP 24576:KyA23Wrwrie3xxmV8QT/DZEFpkgw7GL9dZnnJv3s9vyWXxCxAy9:RNWrm3xc8QT/12ptl5n4JUA
TLSH
T1E3452246B7F91533F93247725DF206830531BCE569B9429B232A66E64EB37C0E83076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Th8ab8zY.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Th8ab8zY.exe
Size 782KB
SHA256 47f9fa8bf5d5297e0c52218322a8b46bce73614e6ae68f23987b2e5ce1d5d76a
MD5 7b73343d4480225462d2549e04319ab0
SHA1 9f9fdfe807ca6fc77b53029bbec857e4b3ab65a1
SHA512 322bbdb8c04f49388c96858f12693732790df508b71fccc9136beae3aff594164ab9164a16e7d55a1ecd88a17ac922ecafe2604a45994ba5f5bc5aa9a384c6b0
SSDEEP 12288:AMrYy90tQkQ/Lz8J8bECq68pJ+JOGQplQkXEF21+gzw2jMp4r9dLgC4a:IysG/MmV8aTQDlEF24gU2bLxL
TLSH
T194051203A7F858B3ED724BB00DB607870F357CA15978478B2756649A4C73BC4AA3176B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rP3vg1ix.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\rP3vg1ix.exe
Size 581KB
SHA256 3ad35bea5e285095f41d49948eed9c99749a218f05edaf940b9c792a4a608b9a
MD5 7e49ae9be474611999b10ecf930f9199
SHA1 47b71e725fa1777ac736dd4de6b30c90d26f3309
SHA512 cc091210ab75a1d26fe3e36d23f5b15a15590c8c21e636d22814dcfc7c42e909e0a96d1f909b9975e7e99ae6605091d7c973c51e7f6879e632af54e86aa4f11e
SSDEEP 12288:tMrPy90eBKtzBOqL8pn+1+Gmpl0DXEF71QgzcUd+BJR:yyTKtz0y8YjmDaEF72gw6+BJR
TLSH
T151C40216A7E85833CEB247B00DF613830F36BDA169B893473255A89F1CB27D1993176B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1sq51Rw0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1sq51Rw0.exe
Size 1.1MB
SHA256 8ffa8c6bcf0b38b229ac57e8a8eacfad2d27bd2b6ec971af827609bfb919495f
MD5 6ef68ec5b2d91cbc9c66fa0553e527ec
SHA1 8d8ab02a5f2433cf12ba62336e4d774f2bbf21d2
SHA512 1a02ccdf3d1be279169bc25eb2a4452be337389b78050811ea4367ca624d5d169c7c7e157a73fe3be13378412e8d94606f41c157b5892cc76c4344ee85d204a6
SSDEEP 12288:h43UZDZw8psxWnUOtPHWy9NcxP0xfpd+Koc/YPhQ9eut8lZBRe71GAaJ3YT31nv6:fxpsxWnUOtPHjLxxdm0wTPJIT3ZvlU
TLSH
T19A459E3238804537EEF721B646EDF929826DE4B0071611EF53D84BEEE6206D3BB36552
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2RX132bB.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\2RX132bB.exe
Size 222KB
SHA256 5f4195c23c9ca65327f8d739db750d19836065478a61ccbb25ca02db4da02348
MD5 b69d18a80c4ea152717cee410affccb7
SHA1 f8639931599f3879f29a512b68875e653a47a010
SHA512 7d60a22e421f7c0554e24d9f394e38bcc3b75572a989f939565fba74065c9447f7503540d2132f288b4f294480a7675ff43c8bfdfb590b2eab12b83cfde31fbc
SSDEEP 3072:TtJXRMeZYncNgckxQdxCr1d2t/q5yoQVZL53pRzzXZQAZ:TJMeucNgckedxCDo/doQVZdZRzzXZQ
TLSH
T16F24D736E304551DE87E437DB01C38B09E707CA2E16ED32F55AA7EED683BB498A144D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/644-38-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/644-36-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/644-35-0x0000000000400000-0x0000000000432000-memory.dmp

Download

memory/2488-42-0x0000000000BF0000-0x0000000000C2E000-memory.dmp

Download

memory/2488-43-0x0000000007E90000-0x0000000008434000-memory.dmp

Download

memory/2488-44-0x0000000007980000-0x0000000007A12000-memory.dmp

Download

memory/2488-45-0x0000000004EF0000-0x0000000004EFA000-memory.dmp

Download

memory/2488-46-0x0000000008A60000-0x0000000009078000-memory.dmp

Download

memory/2488-47-0x0000000007CA0000-0x0000000007DAA000-memory.dmp

Download

memory/2488-48-0x0000000007BB0000-0x0000000007BC2000-memory.dmp

Download

memory/2488-49-0x0000000007C10000-0x0000000007C4C000-memory.dmp

Download

memory/2488-50-0x0000000007C50000-0x0000000007C9C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads